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I.  INTRODUCTION 


"The  survivability  of  an  aircraft  operating  in  an  enemy 
threat  environment  depends  on  its  design  and  on  the 
emphasis  placed  on  its  survivability  throughout  its  life 
cycle.  The  cost  of  modern  aircraft  weapons  systems,  the 
aircraft  and  personnel  attrition  experienced  in  recent 
combat,  and  the  resulting  loss  of  operational  capability 
make  survivability  enhancement  imperative."  This  paragraph 
is  in  the  forward  of  MILITARY  STANDARD  2069/AS  (MILSTD 
2069) ,  Requirements  for  Aircraft  Non-Nuclear  Survivability 
Programs  [Ref.  l:p.  iii] .  This  document  establishes  the 
guidelines  between  the  contractor  and  the  Department  of 
Defense  (DoD)  regarding  survivability  design  in  major 
weapons  systems.  Its  primary  thrust  is  that  survivability 
must  be  a  design  requirement,  one  that  is  incorporated  and 
implemented  from  the  conceptual  design  phase  through  the 
total  life  cycle  of  a  major  weapons  system. 

The  survivability  design  discipline  has  only  recently 
become  a  major  factor  in  weapons  acquisition.  Dr.  R.E. 
Ball,  Professor  of  Aeronautics  at  the  Naval  Postgraduate 
School  (NPS)  in  Monterey,  California  recognized  the 
importance  of  aircraft  survivability  in  a  hostile  threat 
environment  more  than  ten  years  ago.  What  began  as  a  set 
of  notes  for  a  course  taught  at  NPS  has  evolved  into  The 
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Fundamentals  of  Aircraft  Combat  Survivability  Analysis  and 

Design  [Ref.  2];  the  first  textbook  that  fully  examines  the 
total  survivability  picture  from  both  the  design  and 
analysis  points  of  view.  Dr.  Ball's  book  is  the  basis  for 
the  following  case  study  in  the  vulnerability  of  an 
aircraft  in  the  conceptual/preliminary  design  phase. 

The  author,  following  the  words  of  Dr.  Ball 
[Ref.  2:p.  11],  "survivability  must  seriously  be  consid¬ 
ered  by  everyone  during  the  early  design  phase  of  the 
aircraft";  chose  to  do  a  vulnerability  analysis  of  an 
aircraft  of  his  own  design.  This  aircraft  was  designed  to 
fulfill  the  requirements  of  AE-4273,  Aircraft  Conceptual 
Design,  a  graduate  level  aeronautics  course  taught  at  the 
Naval  Postgraduate  School. 

The  course  material  is  based  on  a  seminar  in  conceptual 
design  given  by  Mr.  D.P.  Raymer  of  Rockwell  International. 
The  course  develops  the  aircraft  design  based  on  a  given, 
generic  Request  For  Proposal  (RFP)  for  an  attack  aircraft. 
The  aircraft  was  developed  using  historical  data,  "rules  of 
thumb",  current  aeronautics  trends,  and  regression  equa¬ 
tions.  The  component  layouts  and  structural  arrangements 
were  conceived  by  the  author  using  current  tactical 
aircraft  designs  as  guidelines.  The  resulting  conceptual 
design  was  then  analyzed  with  respect  to  aeronautical  and 
operational  capabilities.  Lift  curves,  drag  polars, 
weights,  and  other  performance  parameters  were  determined 
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to  establish  compliance  with  the  requirements  set  forth  by 
the  RFP . 

The  author's  design  represents  a  generic  aircraft,  one 
in  which  the  systems,  structures,  capabilities,  and 
performance  are  unclassified.  By  conducting  a  vulnerabil¬ 
ity  assessment  of  this  generic,  conceptual  design,  the 
author  hopes  to  obtain  the  widest  dissemination  of  this 
critical  design  consideration. 

Prior  to  discussion  of  this  topic,  it  should  be  stated 
that  this  case  study  is  based  soley  on  the  methodology 
presented  by  Ball  [Ref.  2].  The  author  assumes  the  reader 
is  very  familiar  with  this  methodology,  or  has  the  ref¬ 
erence  readily  available.  The  specifics  of  Dr.  Ball's  book 
will  not  be  repeated  here,  the  reader  is  left  to  refer  to 
the  text  as  necessary  for  any  background  clarification.  In 
each  succeeding  chapter,  references  are  made  to  pages, 
figures,  etc.,  to  assist  the  reader.  (Although  the  author 
feels  that  this  case  study  could  stand  alone  to  someone 
intimately  familiar  with  aircraft  combat  survivability,  the 
language  and  methods  of  this  engineering  discipline  are 
somewhat  unique  and  further  guidance  and  reference  is 
sometimes  very  helpful.) 
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II.  CONCEPTUAL  DESIGN  OVERVIEW 


The  acquisition  process  for  a  major  weapons  system  is  a 
lengthy  and  costly  one.  From  initial  analysis  to  full 
scale  production,  the  time  period  may  span  ten  or  more 
years.  It  is  imperative  that  everything  possible  is  done 
to  ensure  that  the  system  is  the  most  "effective"  one  that 
industry  and  the  government  can  produce. 

Department  of  Defense  Instruction  5000.2  (DoDINST 
5000.2)  [Ref.  3]  is  the  primary  guideline  for  the  Major 
System  Acquisition  Process.  Figure  2.1  [Ref.  4:p.  ICD-1] 
shows  the  tasks  and  Milestones  that  must  be  met  in  order  to 
satisfy  all  of  the  DoD  requirements  for  the  production  of  a 
major  system.  Figure  2.2  [Ref.  4:p.  ICD-2]  presents  the 
different  acquisition  cycle  interrelationships  that  are 
conducted  simultaneously  in  order  to  meet  the  Milestones 
required  by  DoDINST  5000.2  [Ref.  3].  The  conceptual/pre¬ 
liminary  design  phase  activities  are  required  to  be  com¬ 
pleted  between  Milestones  0  and  1. 

By  the  time  Milestone  0  has  been  completed,  the 
following  has  been  accomplished  with  regard  to  system 
development: 

1.  A  threat  has  been  identified  and  a  system  to  counter 
the  threat  has  been  proposed.  The  Defense  Intelli¬ 
gence  Agency  has  validated  the  threat  and  made  the 
DoD  aware  of  the  shortfalls  of  existing  systems  in 
meeting  the  threat. 
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Figure  2 . 1 


Major  Systems  Acquisition  Milestones 
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Figure  2.2  Acquisition  Cycle  Interrelationships 
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DEPLCTr'MENT 


2.  The  Department  of  Defense  responds  with  a  Request 
For  Information  (RFI)  to  the  defense  industry.  This 
is  a  document  soliciting  concepts  for  the  system  the 
DoD  feels  it  needs  to  counter  the  expected  threat. 

The  RFI  will  specify  the  boundary  conditions  to  be 
looked  at  in  the  early  development  of  the  system, 
such  as  survivability,  logistics,  costs,  standardi¬ 
zation  to  existing  systems,  etc..  Industry  in  turn, 
responds  to  the  DOD's  requirements  with  an  estima¬ 
tion  of  the  technological  feasibility  of  building 
the  system  to  fulfill  its  intended  use.  This  system 
is  based  on  historical  data,  engineering  trends,  and 
future  hardware  capability  estimates. 

3.  DoD  looks  at  industry's  response,  and  if  satisfied, 
requests  a  Justification  of  Major  Systems  New  Start, 
or  JMSNS.  ’Here,  approval  from  the  Secretary  of 
Defense  is  required  to  continue  research  and  develop¬ 
ment  into  the  new  system.  Once  that  approval  is 
received,  Milestone  0  has  been  met. 


After  Milestone  0  has  been  met,  DoD  once  again  makes  a 
request  to  industry  to  submit  ideas  or  proposals  for  the 
new  weapons  system.  The  Request  for  Proposal  (RFP)  is  used 
by  the  industry  to  develop  its  conceptual  systems  design. 
The  time  period  between  Milestone  0  and  Milestone  1  is 
usually  two  to  three  years  as  shown  in  Figure  2.1.  The  RFP 
is  much  more  detailed  and  specific  in  its  guidelines  than 
the  RFI.  It  relays  to  industry  specifically  what  the 
weapons  system  must  be  capable  of  doing  to  eliminate  the 
expected  threat.  It  provides  guidelines  with  regards  to 
categories  such  as  aerodynamics,  performance,  size,  weight, 
mission,  weapons/armament,  carrier  suitability/f ield 
performance,  survivability  and  crew  considerations. 

Industry  then  uses  this  document  as  the  baseline  data  for 
its  conceptual/  preliminary  designs.  The  generic  design 
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process  is  shown  in  Figure  2.3.  This  table  breaks  down  the 
design  process  into  three  phases  of  development.  For  the 
purpose  of  this  case  study,  the  aircraft  design  is' assumed 
to  be  between  phases  two  and  three  of  the  design  process. 

The  importance  of  a  survivability  assessment  in  the 
conceptual/preliminary  design  phase  cannot  be  over¬ 
emphasized.  As  seen  in  Figure  2.3,  each  phase  of  the 
design  process  requires  a  corresponding  survivability 
analysis.  It  is  a  requirement  that  is  noted  in  every 
guideline  to  contractors  for  major  weapons  systems.  For 
example,  MILSTD  2069  [Ref.  l:p.  1]  states: 

"A  standard  must  be  developed  in  the  early  stages  of 
major  systems  acquisition.  A  survivability  assessment 
program  is  to  be  included  in  each  contractural  work 
statement.  The  purpose  of  this  is  to  require  studies, 
threat  definitions,  and  contractural  trade-offs  to  allow 
contractors  to  propose  conceptual  or  notational  designs 
which  will  meet  combat  survivability  demands  and  generate 
data  upon  which  firm  design  requirements  will  be  based 
for  full  scale  engineering  development." 

From  an  economic  standpoint  alone,  the  government 
should  demand  conceptual  trade-off  studies  using  surviv¬ 
ability  assessment  methodology.  It  is  much  easier,  and 
much  more  cost  effective,  to  change  a  design  while  in  the 
"paper  phase" ,  than  to  attempt  to  modify  an  existing  air¬ 
frame.  The  assessment  in  the  conceptual/preliminary  phase 
provides  an  opportunity  to  examine  the  effects  of  changes 
in  the  parameters  and  the  design.  How  these  changes 
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CONCEPTUAL/PRELIMINARY  DESIGN 
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Figure  2.3  Generic  Design  Process 
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affect  the  aircraft's  survivability,  performance,  tactics, 
maintainability,  reliability,  armament  and  cost  can  be 
evaluated  and  assessed  with  regards  to  the  benefits  and 
penalties.  The  following  chapter  will  introduce  the 
survivability  program  and  the  steps  necessary  for  its 
implementation  and  completion. 
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III.  SURVIVABILITY  PROGRAM  OVERVIEW 


The  contractor  for  a  major  weapons  system  must 
establish  a  DoD  approved  Survivability  Program  and  inte¬ 
grate  it  into  the  company's  management  system.  Ball  [Ref. 

2 :p.  34]  ,  states: 

"To  develop  a  survivable,  cost-effective  aircraft 
requires  a  systematic  survivability  program  beginning  in 
the  conceptual  phase  and  continuing  throughout  the  life 
cycle  of  the  aircraft.  It  is  essential  that  surviva¬ 
bility  criteria  be  established  early  in  the  conceptual 
phase  and  that  alternative  designs  and  utilization 
solutions  be  developed.  By  developing  this  information 
before  the  final  design  configuration  is  established, 
the  most  cost  effective  survivability  enhancement 
techniques  can  be  identified." 

MILSTD  2069,  Requirements  for  Aircraft  Non-Nuclear 
Survivability  Programs  [Ref.  1],  is  the  standard  the  DoD 
uses  to  provide  uniform  requirements  and  guidelines  for 
establishing  survivability  programs.  Figure  3.1  [Ref.  l:p. 
2]  shows  the  life  cycle  of  a  typical  survivability  program. 
It  shows  that  survivability  is  a  continuous  process  that 
begins  in  the  initiation  phase  and  continues  throughout  the 
life  cycle  of  a  weapons  system. 

The  survivability  of  an  aircraft  is  related  to  two 
fundamental  attributes,  susceptibility  and  vulnerability. 
The  susceptibility  of  an  aircraft  can  be  defined  as  the 
inability  of  the  aircraft  to  avoid  being  hit  while 
conducting  its  mission.  It  is  dependent  upon  how  well  the 
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Figure  3.1  Survivability  Life  Cycle 
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enemy  is  able  to  detect,  identify,  track,  acquire,  and  hit 
the  aircraft  as  a  target.  The  vulnerability  of  an  aircraft 
is  the  measure  of  how  much  the  system  or  systems  are 
degraded  due  to  the  hit  by  the  damage  causing  mechanisms. 

A  survivability  program  is  concerned  with  all  the  design 
factors  that  influence  the  aircraft's  susceptibility  and 
vulnerability. 

MILSTD  2069  [Ref.  l:pp.  12-25]  defines  the  following 
tasks  that  must  be  included  in  a  survivability  program: 

1.  Mission  Threat  Analysis 

2.  Aircraft  Geometric  Configuration 

3.  Flight  and  Mission  Essential  Functions 
Identification 

4.  Failure  Mode,  Effects,  and  Criticality  Analysis 

5.  Aircraft  Vulnerability  Assessment 

6.  Aircraft  Susceptibility  Assessment 

7.  Aircraft  Survivability  Assessment 

8.  System/Cost  Effective  Analysis 

9.  Survivability  Enhancement  Trade-Off  Studies 

10.  Combat  Damage  Repair  Assessment 

Most  of  these  tasks  will  be  explained  in  a  general  manner 
according  to  MILSTD  2069  [Ref.  1],  Then,  in  subsequent 
chapters,  the  first  five  tasks  will  be  accomplished  using 
the  generic  aircraft. 


A.  MISSION  THREAT  ANALYSIS 

The  missions  of  the  aircraft  and  the  expected  threat 
systems  are  expressed  in  the  DoD  generated  specifications 
such  as  the  RFI  and  RFP.  The  expected  flight  profiles  and 
defense  situations  that  the  DoD  has  identified  are  used  to 
develop  designs  and  conduct  trade-off  studies. 
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The  contractor  attempts  to  define  each  operational  mode 
in  terms  of  aircraft  performance,  weights,  armament,  etc., 
to  meet  the  expected  threat  scenario  that  has  been  given  as 
the  basis  for  the  design.  Encounter  conditions  should  be 
determined  and  used  as  the  basis  for  survivability  design 
and  trade-off  studies.  These  studies  are  used  to  ensure 
the  aircraft  can  operate  effectively  in  the  threat  environ¬ 
ment.  It  is  important  to  identify  all  possible  threats  the 
aircraft  may  encounter  during  a  mission.  If  the  aircraft 
is  capable  of  a  multifunction  role,  then  the  expected 
threats  will  vary  according  to  the  situation  and  the  envi¬ 
ronment  the  aircraft  is  in. 

According  to  Ball  [Ref.  2:p.  115],  the  Mission  Threat 
Analysis  can  be  divided  into  three  phases: 

(1)  Define  the  mission  and  the  flight  envelopes  of  the 
aircraft.  This  will  encompass  operating  environ¬ 
ments,  mission  types  and  flight  conditions. 

(2)  Define  the  expected  threat  environment  for  each 
mission  and  theater.  Here  the  enemy  systems  are 
analyzed  to  determine  their  envelopes. 

(3)  Combine  the  data  gathered  in  the  first  two  phases. 
Estimate  the  likelihood  of  encounter  between  the 
aircraft  and  each  threat  system,  and  identify  the 
conditions  of  each  at  the  time  of  encounter. 


B.  AIRCRAFT  GEOMETRIC  DESCRIPTION 

The  aircraft  geometric  description  is  the  development 
of  a  detailed,  accurate  description  of  the  aircraft  for  use 
in  the  vulnerability  analysis.  For  an  aircraft  in  the 
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conceptual/preliminary  design  phase,  as  much  technical  and 
functional  data  as  possible  must  be  collected  on  each  major 
system  of  the  aircraft.  This  data  should  include,  but  need 
not  be  limited  to: 

1.  engineering  drawings 

2.  trade-off  study  results 

3.  3-view  scale  drawings 

4.  narrative  descriptions  of  the  proposed  systems 

5.  block  diagrams 

6.  flow  charts 

7.  projected  performance  data 

8.  cross  section  drawings 

For  an  aircraft  currently  in  the  inventory,  its  NATOPS  and 
MIMS  could  be  added  to  this  list  to  provide  a  thorough  des¬ 
cription  of  the  aircraft,  its  systems  and  operating  capa¬ 
bilities  . 

For  aircraft  being  analyzed  using  current  computer 
programs  for  single  hit  vulnerability  (see  Ball  [Ref.  2:p. 
192-198]),  this  collected  data  is  used  to  generate  a  geo¬ 
metric  model  and  descriptor  of  the  aircraft  and  its 
systems.  This  model  is  then  used  with  the  computer  pro¬ 
grams  to  develop  vulnerability  indices  for  the  aircraft. 
Such  a  task  is  beyond  the  scope  of  this  case  study. 

C.  FLIGHT  AND  MISSION  ESSENTIAL  FUNCTIONS 

Using  the  missions  defined  by  the  DOD,  the  contractor 
must  determine  the  flight  and  mission  essential  functions 
for  each  mission  phase.  A  flight  essential  function  is 
that  function  performed  by  one  or  more  components  on  the 
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aircraft  which  permits  the  aircraft  to  sustain  flight 
through  adequate  lift,  thrust  and  control. 

A  mission  essential  function  is  a  function  performed  by 
one  or  more  components  on  the  aircraft  that  permits  it  to 
accomplish  its  defined  mission.  For  example,  the  weapons 
delivery  system  of  an  attack  aircraft  is  not  a  mission  es¬ 
sential  function  during  the  take-off,  climb-out  or  cruise 
phases  of  a  flight.  But  it  is  definitely  a  mission  essen¬ 
tial  function  during  an  ordnance  delivery  run  on  a  desig¬ 
nated  target. 

D.  FAILURE  MODE,  EFFECTS,  AND  CRITICALITY  ANALYSIS  (FMECA) 

The  Failure  Mode,  Effects,  and  Criticality  Analysis 
(FMECA)  is  a  multidiscipline  design  procedure,  utilizing 
design  inputs  such  as  system  reliability,  maintainability, 
and  safety  to  define  the  response  of  the  aircraft  and  its 
systems  to  damage  caused  by  the  damage  mechanisms.  As 
such,  it  is  one  of  the  most  important  parts  of  the  vul¬ 
nerability  assessment.  The  ultimate  goal  of  this  analysis 
is  to  identify  the  aircraft's  critical  components.  A 
critical  component  is  defined  as  one  whose  damage  or  loss 
could  lead  to  an  attrition  level  or  mission  abort  level 
kill. 

Utilized  in  the  conceptual  design  phase,  MILSTD  2069 
[Ref.  l:p.  13],  defines  the  FMECA  as  a  procedure  that: 
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(1)  Documents  all  possible  potential  failures  for  each 
component  or  subsystem. 

(2)  Determines  by  prediction  and  analysis  the  effect  of 
each  of  the  failures  on  system  operation. 

(3)  Identifies  potential  failures  critical  to  personnel 
safety. 

(4)  Ranks  each  failure  according  to  effect  severity. 

The  FMECA  procedure  is  performed  in  two  steps,  (1)  a  Fail¬ 
ure  Mode  and  Effects  Analysis  (FMEA)  and  (2)  a  Damage  Mode 
and  Effects  Analysis  (DMEA) .  Another  analysis  tool, not 
formally  required  by  MILSTD  2069  is  the  Fault  Tree  Analysis 
(FTA) .  This  can  be  used  in  addition  to,  or  in  place  of,  an 
FMEA  if  one  is  not  available. 

1 .  Failure  Mode  and  Effects  Analysis  (FMEA) 

Figure  3.2  [Ref.  l:p.  15]  shows  the  role  of  the 
FMECA  in  the  overall  vulnerability  assessment.  In  the  FMEA 
phase: 

(1)  The  contractor  must  identify,  to  the  best  of  his 
theoretical  and  analytical  ability,  all  possible 
failures  and  their  effects  on  the  aircraft. 

(2)  Each  critical  component  is  identified  and  its 
functions  defined. 

(3)  All  possible  failures  of  the  component  are  examin¬ 
ed,  including  those  due  to  its  location  within  the 
aircraft. 

(4)  The  results  of  these  failures  must  be  related  to 
the  components  own  functional  ability  and  also  to 
the  functional  abilities  of  the  system  from  which 
that  component  is  a  part.  This  in  turn,  is  related 
to  effects  of  component  damage  in  the  overall 
aircraft. 
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Figure  3.2  Interfaces  of  the  FMECA  Process 
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CRITICAL 

COMPONENTS 


The  major  input  to  the  FMEA  is  the  physical  and 
functional  description  of  the  aircraft  and  its  systems, 
components,  etc..  This  information  is  the  Aircraft 
Geometric  Description  as  discussed  earlier.  The  output  of 
the  FMEA  is  usually  in  the  format  of  a  self-explanatory 
table  or  matrix  (Figure  3.3)  [Ref.  2:p.  142].  The 
contractor  must  be  as  specific  as  possible  to  the  current 
level  of  design.  For  the  conceptual/preliminary  level, 
major  systems  and  some  basic  components  can  be  broken  down 
into  sufficient  detail  to  provide  a  thorough  analysis.  In 
later  stages,  the  actual  "nuts  and  bolts"  of  the  components 
are  examined  for  possible  failure  modes. 

2 .  Damage  Mode  and  Effects  Analysis  (DMEA) 

The  second  part  of  the  FMECA,  the  DMEA,  is  related 
to  and  dependent  upon  predicted  damage  from  exposure  to  the 
combat  environment.  The  contractor  must  assess  the  com¬ 
ponent's  potential  failures  due  to  the  damage  mechanisms, 
relate  these  failures  to  the  kill  level  required  in  the 
assessment,  and  quantify  the  component's  ability  to 
continue  to  operate  in  the  hostile  environment. 

The  kill  level  referred  to  in  the  previous 
paragraph  can  be  any  one  of  three  categories  of  aircraft 
kill  that  measure  the  degree  to  which  the  aircraft  suffers 
performance  degradation.  These  categories  are  attrition 
kill,  mission  abort  kill  and  forced  landing  kill.  The 
attrition  kill  is  the  one  most  commonly  analyzed,  and 
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is  a  measure  of  the  severity  of  aircraft  damage  that  causes 
it  to  be  lost  from  the  inventory.  Time  is  the  most 
important  parameter  in  the  attrition  kill,  therefore  it  is 
the  basis  for  the  four  levels  of  attrition  kill.  These 
levels  are: 

1.  KK  kill:  Damage  that  will  cause  an  aircraft  to  dis¬ 
integrate  immediately  upon  being  hit. 

2.  K  kill:  Damage  that  causes  an  aircraft  to  fall  out 
of  manned  control  within  30  seconds  after  being  hit. 

3.  A  kill:  Damage  that  causes  an  aircraft  to  fall  out 
of  manned  control  within  5  minutes  after  being  hit. 

4.  B  kill:  Damage  that  causes  an  aircraft  to  fall  out 
of  manned  control  30  minutes  after  being  hit. 

The  A  level  or  5  minute  attrition  kill  is  the  kill  level 
usually  used  by  DoD  and  industry  to  evaluate  the  vulner¬ 
ability  of  an  aircraft.  The  A  level  attrition  will  also  be 
used  for  this  case  study. 

The  DMEA  relies  heavily  on  information  gained  from 
a  correct  and  thorough  FMEA.  The  DMEA  also  identifies  any 
secondary  damage  caused  by  the  primary  damage  mechanism. 

For  example,  a  secondary  fire  caused  by  the  detonation  of 
an  HEIT  projectile  inside  the  aircraft's  structure.  Ball 
[Ref.  2:p.  145]  provides  a  table  (Table  3.1)  of  the  most 
important  damage  caused  failure  or  kill  modes  of  the  major 
systems.  Each  system  mentioned  is  broken  down  in  the  DMEA 
and  analyzed  to  determine  the  lowest  level  of  component 
failure. 
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TABLE  3  o 1  SYSTEM  DAMAGE-CAUSED  KILL  MODES 
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Fire /explosion 


Because  the  DMEA  analyzes  the  criticality  of  fail¬ 
ure,  the  output  from  the  study  is  more  detailed  and  elab¬ 
orate  than  from  an  FMEA.  The  DoD  will  notify  the 
contractor  on  the  required  DMEA  data  necessary  for  the 
particular  weapons  system  being  assessed.  The  depth  of 
detail  and  breakdown  will  depend  on  which  design  phase  the 
assessment  takes  place  in. 

There  are  four  sets  of  data  which  make  up  the  DMEA 
output.  The  first  set  is  the  DMEA  Matrix  or  Table  (Figure 
3.4)  [Ref.  l:p.  17].  The  contractor  must  break  down  the 
aircraft  systems  to  their  component  level;  and  relate  these 
components  and  their  failure  modes  to  the  probability  of 
kill  given  a  hit  P(k/h)  functions,  kill  level,  and  redun¬ 
dancy  levels.  In  a  conceptual/preliminary  design  phase, 
the  contractor  uses  historical  data  and  predicted  engineer¬ 
ing  specifications  of  materials  and  components  to  make  this 
analysis . 

The  second  type  of  data  produced  from  an  DMEA  is  a 
Disablement  Diagram.  Figure  3.5  [Ref.  2:p.  144]  is  the 
graphical  representation  of  the  results  of  the  FMEA  and 
DMEA.  The  contractor  uses  the  system  design  proposals  and 
predicted  survivability  of  each  component  to  graphically 
illustrate  the  failures  of  the  system  to  a  specified  kill 
level . 
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Example  DMEA  Matrix 
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Figure  3 . 5 


Example 


Disablement  Diagram 
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The  third  set  of  data  generated  by  a  DMEA  is  the 
Kill  Tree  or  Kill  Diagram.  The  Kill  Diagrams  are  dev¬ 
eloped  by  combining  data  from  the  Flight  and  Mission 
Essential  Functions  Analysis,  FMEA,  DMEA,  Disablement 
Diagrams,  and  should  include  evaluation  by  members  of  the 
operational  community  and  engineers  responsible  for  the 
design  of  the  aircraft.  They  are  a  function  of  kill  level 
and  graphically  depict  the  combination  of  components  and 
systems  that  must  be  sufficiently  degraded  to  effect  the 
particular  kill  level  on  the  aircraft. 

The  kill  diagram  is  a  visual  illustration  and  iden 
tification  of  the  critical  components  of  the  aircraft  and 
their  redundancy  relationships.  It  is  constructed  by  the 
contractor  for  the  aircraft  in  a  specific  flight  condition 
The  example  kill  diagram  shown  in  Figure  3.6  [Ref.  2:p. 
153]  illustrates  the  effect  of  redundancy  on  a  system. 

The  last  data  source  of  the  DMEA  is  the  set  of 
"probability  of  kill,  given  a  hit"  functions  (P(k/h). 

These  functions,  or  values  are  assigned  to  a  component 
based  on  its  response  to  being  impacted  by  a  damage 
mechanism  (fragment  or  projectile).  The  contractor 
normally  uses  government  provided  or  specified  P(k/h) 
values  where  required.  In  a  conceptual/preliminary  design 
phase  the  contractor  also  uses  historical  data  and 
available  ballistic  test  data  to  ascertain  the  amount  of 
damage  the  component  will  sustain.  The  P(k/h) 
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Figure  3 . 6 


Example  Kill  Diagram 
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for  each  component  requires  sound  engineering  judgement  and 
realistic  design  assessments.  The  functions  can  be  expres¬ 
sed  graphically  as  a  function  of  damage  mechanism  mass  and 
velocity  (Figure  3.7)  [Ref.  2:p.  156],  or  in  analytical 
format.  The  contractor  uses  the  P(k/h)  functions  for 
components  that  can  be  killed  by  a  single  shot  and  for 
larger  systems  such  as  engines  which  are  divided  into 
segments  with  specific  P(k/h)  values  for  each  segment. 

3 .  Fault  Tree  Analysis  (FTA) 

As  previously  mentioned,  the  Fault  Tree  Analysis  is 
not  required  by  MILSTD  2069  as  a  task  in  a  survivability 
assessment.  It  is  another  method  used  to  identify  critical 
components.  It  usually  conducted  when  there  has  been  no 
FTA  provided  for  the  system  under  analysis.  It  can 
actually  replace  the  FMEA  and  is  done  in  parallel  to  the 
DMEA. 

Ball  [Ref.  2:p.  149]  calls  this  analysis  the  "top 
down"  approach.  An  undesirable  event  is  the  catalyst  for 
the  Fault  Tree  Analysis,  then  the  events  or  combination  of 
events  that  caused  the  undesirable  event  are  determined. 

The  undesirable  event  for  this  case  study  is  the  A-level 
attrition  kill.  The  contractor  will  analyze  what  could 
cause  this  event  to  occur;  breaking  down  systems  into  their 
components  and  examining  them  for  levels  of  redundancy,  if 
any.  As  seen  from  Figure  3.8  [Ref.  2:p.  149],  logic 
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Figure  3.7  Example  P(k/h)  Function 
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Figure  3 . 8  Generic  Fault  Tree  Diagram 
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symbology  helps  to  branch  the  fault  tree  by  recognizing 
component  redundancy  and  the  relationship  between  cause  and 
effect . 

E.  AIRCRAFT  VULNERABILITY  ASSESSMENT 

From  a  contractor's  viewpoint,  MILSTD  2069  [Ref.  1]  is 
very  specific  in  its  requirements  concerning  a  vulner¬ 
ability  assessment.  The  data  and  information  discussed  in 
the  previous  paragraphs  is  the  backbone  of  any  vulnerabil¬ 
ity  assessment.  In  the  conceptual/preliminary  design 
phase,  the  contractor  has  the  freedom  to  use  either  his  own 
or  government  approved  methodology.  Regardless  of  the 
methodology,  it  must  meet  the  following  objectives  as  set 
forth  by  MILSTD  2069  [Ref.  l:p.  21]. 

(1)  Identify  deficiencies  and  evaluate  methods  and 
design  changes  to  reduce  vulnerability. 

(2)  Provide  quantified  measures  of  vulnerability  for 
specific  threats  and  kill  levels  for  use  in  design 
analyses  and  trade-off  studies. 

(3)  Provide  inputs  for  the  survivability  assessment  of 
the  aircraft. 

Vulnerability  assessments  can  take  various  forms.  The 
contractor  may  use  detailed  computer  analyses  with  geo¬ 
metric  models  and  various  computer  programs  such  as  those 
mentioned  by  Ball  [Ref.  2:pp.  192-198].  Because  this 
aircraft  is  in  the  conceptual  design  phase,  this  method 
will  not  be  used  for  this  case  study. 
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The  contractor  must  also  do  a  detailed  analysis  for  the 
aircraft's  single  hit  vulnerable  area  using  the  P(k/h) 
functions  for  the  components.  According  to  Ball  [Ref.  2:p. 
154],  the  vulnerable  area  is  "a  theoretical  non-unique  area 
presented  to  the  threat,  that  if  hit  by  a  damage  mechanism, 
would  result  in  an  aircraft  kill. 

The  contractor  may  be  required  to  develop  a  vulner¬ 
ability  analysis  based  on  the  P(k/d) ,  the  "probability  of 
kill  given  a  detonation  envelope"  if  the  weapons  system  is 
expected  to  encounter  HE  warheads  in  its  mission  profile. 

Another  area  of  vulnerability  study  is  the  laser 
threat.  The  P(l/o) ,  "  probability  of  kill  given  a  specific 
laser  power  lock-on  for  a  specified  period  of  time.  This 
is  becoming  extremely  important  with  current  technology 
development. 

F.  AIRCRAFT  SUSCEPTIBILITY  ASSESSMENT 

The  contractor  must  utilize  the  results  of  the  Mission 
Threat  Analysis  to  conduct  a  proper  susceptibility  assess¬ 
ment.  Since  the  susceptibility  of  an  aircraft  depends  upon 
the  mission  scenario,  the  threat  encountered,  and  the 
aircraft  itself,  a  complete  and  thorough  Mission  Threat 
Analysis  is  essential. 

The  contractor  makes  judgements  and  assessments  based 
on  the  conceptual  design,  known  or  proposed  tactics, 
aircraft  designed  performance,  the  characteristics  of  the 
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threat,  its  lethality,  and  the  environment  to  assess  how 
well  an  aircraft  can  avoid  being  damaged'  while  performing 
its  assigned  mission.  Or  it  can  be  stated  that  the 
contractor  uses  all  weapons,  aircraft,  and  environmental 
data  to  determine  the  net  probability  the  aircraft  is  hit 
by  the  damage  mechanism. 

There  are  several  specific  weapons  and  aircraft 
parameters  that  the  contractor  must  consider  when 
performing  this  assessment. 

(1)  The  threat  parameters  include: 

-detection 

-acquisition 
-lock  on 
-track 

-missile  guidance 
-gun  fire  control 
-command  and  control  interfaces 

(2)  The  aircraft  parameters  include: 

-detectable  signatures  (IR,  RCS,  aural) 

-counter  measures 

-tactics 

-flight  path  and  performance 
The  contractor  must  make  trade-off  studies,  especially 
in  the  conceptual  design  phase,  during  a  susceptibility 
assessment.  For  example,  industry  must  weigh  the  advan¬ 
tages/penalties  in  weight  and  cost  replacing  conventional 
nozzles  with  2-D  nozzles  to  reduce  the  IR  signature  of  an 
exhaust  system.  Or,  adding  a  more  powerful  jammer  based  on 
the  perceived  threat,  and  fighting  with  the  weight,  cost 
and  size  parameters  inherent  in  such  a  decision.  There  are 
many  analytical  processes  involved  in  this  type  of 
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analysis;  the  contractor  must  document  each  analysis  and 
produce  the  most  efficient  solution  to  the  aircraft's 
susceptibility. 


G.  AIRCRAFT  SURVIVABILITY  ASSESSMENT 

The  Survivability  Assesment  is  the  capstone  of  the 
survivability  program.  It  is  the  culmination  of  a  quan¬ 
titative  measure  of  the  aircraft's  survivability.  The 
contractor  must  combine  the  results  of  all  of  the  above 
mentioned  assessments  and  determine  the  effectiveness  of 
the  weapons  system  it  has  designed.  Specifically,  the 
contractor  is  required  by  MILSTD  2069  [Ref.  l:p.  23]  to 
complete  an  assessment  using: 

(1)  The  results  of  the  mission  threat  analysis. 

(2)  The  results  of  the  vulnerability  analysis. 

(3)  The  results  of  the  susceptibility  analysis. 

The  assessment  should  address  the  following  categories: 

(1)  Laser  availability  if  DOD  specifies  the  need. 

(2)  System  cost  effective  analysis.  This  should  be 
done  as  trade-off  studies  to  determine  the  point 
where  making  the  plane  survivable  is  no  longer  cost 
effective.  A  measure  of  effectiveness  is  required 
for  comparison  purposes.  This  will  show  the 
relative  effectiveness  of  a  system  with  its 
inherent  costs.  In  the  conceptual  design  phase, 
this  is  limited  by  the  stage  of  system  development. 

(3)  Survivability  enhancement  trade-off  studies.  The 
contractor  is  responsible  to  provide  an  in  depth 
analysis  to  DOD  identifying  the  effects,  benefits 
and  penalties  in  survivability  enhancement 
parameters.  A  trade-off  study  shall  describe  the 
survivability  enhancement  techniques  considered; 
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and  how  vulnerability  and  susceptibility  reduc¬ 
tion  was  realized  by  the  use  of  these  techniques. 
Coincident  with  this  should  be  an  assessment  on  the 
aircraft's  performance,  weight,  cost,  reliability, 
etc.,  if  such  an  enhancement  were  incorporated. 

The  contractor's  development  of  a  survivability  assess¬ 
ment  is  critical  to  the  design  of  the  aircraft.  The  con¬ 
ceptual/preliminary  phase,  with  its  degree  of  freedom, 
makes  it  an  excellent  phase  to  assess  a  system,  from  both 
cost  effective  and  performance  points  of  view. 


H.  COMBAT  DAMAGE  REPAIR  ASSESSMENT 

The  contractor  must  design  a  repairable  system.  For  a 
survivability  program,  the  contractor  estimates  the  man¬ 
hours,  costs,  logistics  and  repair  levels  of  the  aircraft 
in  a  combat  environment.  In  the  conceptual/preliminary 
design  phase,  the  contractor  must  highlight  design  items 
for  quick  turn-around  fixes;  i.e.,  those  he  feels  are 
inherent  in  the  design  of  the  system.  He  must,  if  able, 
identify  and  describe  complete  repairs  and  proposed  levels 
for  major  repair  systems.  Finally,  he  must  identify  those 
spare  parts  which  would  require  a  long  lead  time  in  pro¬ 
curement;  and  the  amount  of  parts  stocking  required  for  a 
combat  environment. 

MILSTD  2069  [Ref.  1]  concludes  its  documentation  of  the 
groundwork  for  survivability  program  by  briefly  discussing 
the  required  survivability  enhancement  features  that  are  to 
be  considered  in  a  design.  These  are  too  numerous  to 
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discuss  in4ividually .  The  conceptual  design  phase  requires 
that  enhancement  features  be  the  basis  for  trade-off  stud¬ 
ies.  The  design  survivability  enhancement  features  will 
discussed  in  the  case  study  in  the  FMECA,  then  engineering 
analysis  will  be  used  to  recommend  improvements  in  the 
design  including  incorporation  of  applicable  enhancement 
features  listed  in  MILSTD  2069  [Ref.  l:pp.  25-35]. 

The  following  chapters  encompass  the  case  study  itself. 
The  next  chapter  defines  the  design  of  the  aircraft  used 
in  the  assessment. 


45 


IV.  THE  AIRCRAFT 


The  aircraft  used  for  this  case  study  is  the  result  of 
a  course  the  author  took  at  NPS.  An  RFP  was  developed  by 
Professor  R.D.  Zucker  to  be  used  as  the  basis  for  the  de¬ 
sign.  It  is  a  generic,  unclassified  RFP,  having  no  known 
connection  to  any  existing  or  proposed  weapons  system.  The 
RFP  was  presented  as  follows. 

A.  REQUEST  FOR  PROPOSAL 


-TYPE: 

Light/medium  weight  attack  aircraft, 
land  or  carrier  based. 

-CREW: 

1  (single  seat) 

-MINIMUM  PAYLOAD: 

4  cruise  missiles  (1200  lbs.  each) 

4  sidewinder  missiles  (190  lbs. 
each) 

-PROPULSION  SYSTEM: 

generic  "rubber  engine"  capable  of 
producing  20,000  lbs.  thrust  at  sea 
level . 

-DESIGN  SPEED: 

Mach  1.1  (dash  speed-total  mission 
may  be  subsonic) . 

-TAKE-OFF  DISTANCE: 

3000  ft.  (from  land) 

-LANDING  DISTANCE: 

3500  ft.  (to  land) 

-PRIMARY  MISSION: 

Low  level  ordnance  delivery  from  ei¬ 
ther  carrier  or  land  base,  with  full 
payload  and  no  external  fuel. 

(See  V.  Mission  Threat  Analysis) 

-ALTERNATE  MISSION: 

High  level  ordnance  delivery  from 
either  carrier  or  land  base,  with 
full  payload  and  no  external  fuel. 
(See  V.  Mission  Threat  Analysis) 
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-MANEUVERABILITY : 


Design  load  factor — 8  g's. 

Sustained  turn  rate  at  P(s)  =  0  is 
4  g's  at  Mach  0.8  and  30,000  ft. 
Instantaneous  turn  rate  at  8  g's  is 
16  degrees  per  second  at  the  "corner 
speed  and  30,000  ft. 

From  this  RFP  and  course  material,  the  conceptual 
design  of  the  A-20  ELIMINATOR  was  created  (See  Figures  4.1 
and  4.2).  Because  the  purpose  of  this  case  study  is  to 
assess  the  vulnerability  of  the  aircraft  in  the  conceptual/ 
preliminary  design  stage,  the  majority  of  work  involved  in 
creating  the  response  to  the  RFP  has  been  omitted.  This 
response,  which  was  supposed  to  represent  a  defense 
contractor's  submission  of  a  proposed  design,  required  175 
pages  to  complete.  For  this  reason,  a  summary  of  design 
and  performance  specifications  for  the  ELIMINATOR  follows. 


B.  DESIGN  SUMMARY 
Total  Airplane 


Overall 

length 

48.23  ft 

Overall 

height 

15.20  ft 

Wing 


Area  (S) 

415.4  ft 

Span  (b) 

38.129  ft 

Aspect  Ratio  (AR) 

3 . 5 

Chords 

Root  Chord 

17.43  ft 

Tip  Chord 

4.4  ft 

MAC 

12.2  ft 

y-MAC 

7.6  ft 

L.E.  Sweep 

41.5  deg 

c/4  Sweep 

35.7  deg 

Taper  Ratio 

0.25 

t/c 

7.5% 
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A“20  'Eliminator 


Figure  4.2  A-20  ELIMINATOR  (four  view) 
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Horizontal  Tails 


Tail  Coefficient 
Area  (S  per  tail) 

L.E.  Sweep 

Span  (exposed  per  tail) 

Taper  Ratio 
Chords 

Root  Chord 
Tip  Chord 
MAC 
y-MAC 

t/c 

Vertical  Tails 

Tail  Coefficient 
Area  (S  per  tail) 

L.E.  Sweep 

Span  (exposed  per  tail) 

Taper  Ratio 
Chords 

Root  Chord 
Tip  Chord 
MAC 
y-MAC 

t/c 

Engines 

Thrust-to-Weight 

with  afterburner 
w/o  afterburner 
Number  of  Engines 
length 
diameter 
weight 

Maximum  Thrust  at  Sea  Level 
Capture  Area  (per  engine) 

Aircraft  Weight 

W(o) 

W(e) 

W(f) 

Landing  Gear 

Main  Landing  Gear  (single  tire) 
Diameter 
Width 

Wheel  Diameter 


0.4 

67.6  ft 
41.5  deg 
8.25  ft 
0.48 

10.0  ft 
4.8  ft 
7.78  ft 
4.83  ft 
7.5% 


0.6 

52.8  ft 
41,45  deg 
8.0  ft 
0.342 

9.5  ft 
3.25  ft 
6.88  ft 
3.97  ft 
7.5% 


I. 04 
0.61 
2 

II. 0  ft 
2.4  ft 
1450.0  lbs 
38600  lbf 
1.68  sq  ft 


37327  lb 
18089  lb 
10800  lb 


28.7  in 
8.6  in 
13.4  in 
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Main  Landing  Gear  Shock 

Stroke 

Strut  Diameter 

Minimum  Shock  Length 

25  in 

4.1  in 

5.2  ft 

Nose  Landing  Gear (dual  tire) 
Diameter 

Width 

Wheel  Diameter 

21.5  in 

6.8  in 

10.1  in 

Nose  Landing  Gear  Shock 

Stroke 

Strut  Diameter 

Minimum  Shock  Length 

24.2  in 

2.0  in 

5.04  ft 

Balance  Parameters 

Static  Tail  Down  Angle 
Turnover  Angle 

15 . 0  deg 

53.97  deg 

AERODYNAMICS  SUMMARY 

Design  Lift  Coefficient  (Mach  0.87) 

0.254 

Maneuvering  Devices 

L.E.  Flaps 

T.E.  Flaps 

0-34  deg  defl 
0-17  deg  defl 

PERFORMANCE  SUMMARY 

Take-off  distance 

Landing  distance 

1706  ft 

3535  ft 

Maximum  Speed 

Sea  level  with  AB/without  AB 
30000  ft  with  AB/without  AB 

1.04M/0.8M 

1. 1M/0. 9M 

For  the  purpose  of  this  case  study,  the  author  went 


beyond  the  purely  conceptual  design  arena  into  some 
preliminary  design  work;  creating  and  sizing  the  aircraft's 
subsystems,  such  as  the  hydraulics,  flight  controls, 
propulsion,  etc.  This  was  done  to  ensure  a  realistic 
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component  base  for  the  case  study.  This  design  work  was 
based  on  existing  systems  in  the  inventory  and  current 
developments  and  technology  in  aircraft  design. 

It  was  not  the  author's  intent  to  design  the  most 
survivable  aircraft  possible.  The  A-20  was  designed  to  be 
representative  of  current  technology.  The  survivability 
features  inherent  in  the  design  will  only  lead  to  a  better 
understanding,  of  the  methodology  used  in  the  assessment. 
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V.  A-20  MISSION  THREAT  ANALYSIS 


The  Mission  Threat  Analysis  is  the  first  step  in  an 
aircraft  survivability  assessment.  Background  on  the 
methodology  for  the  Mission  Threat  Analysis  is  found  in 
Chapter  3  of  Ball  [Ref.  2].  Specifically,  Section  3.7 
(pages  115-116)  presents  the  steps  Ball  delineates  as 
necessary  for  a  proper  assessment. 

A.  MISSION  ANALYSIS 

The  Mission  Analysis  for  an  aircraft  in  the  concep¬ 
tual/preliminary  design  phase  is  driven  by  the  RFP .  For  the 
A-20,  the  RFP  requires  the  primary  mission  to  be  a  high- 
low/low-high  mission  with  speeds  and  altitudes  depicted 
generically  in  Figure  5.1.  The  ordnance  load  is  dependent 
upon  target  selection  and  intelligence.  The  alternate 
mission  is  stated  in  the  RFP  as  a  high-high/high-high 
mission  profile  as  depicted  generically  in  Figure  5.2. 

Again  the  ordnance  load  is  dependent  upon  target  selection 
and  intelligence. 

From  the  design  standpoint,  the  A-20  is  a  multi-mission 
attack  aircraft.  It  is  designed  to  deliver  ordnance  on  a 
designated  target  in  a  variety  of  roles  that  fit  both  the 
primary  and  alternate  mission  descriptions  such  as  close 
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2  3  8  9 


• - •  • - • 


0-1  Taxi  and  take-off 

1- 2  Climb  to  30,000  ft.  cruise  altitude 

2- 3  Cruise  at  0.75  Mach  for  250  NM  to  ingress  area 

3- 4  Descend  to  ingress  point  (sea  level) 

4- 5  Ingress  50  NM  at  0.9  Mach  to  target  area 

5- 6  Low  altitude  ordnance  delivery  on  target 

6- 7  Fly  50  NM  to  egress  point  at  0.9  Mach 

7- 3  Climb  to  30,000  ft.  cruise  altitude 

8- 9  Cruise  at  0.8  Mach  for  250  NM  to  descent  point 

9- 10  .  Descend  to  loiter  altitude 

10- 11  Loiter  at  0.27  Mach  at  sea  level  for  20  minutes 

11- 12  Approach,  land  and  taxi  to  ramp 


Figure  5.1  Generic  High-Low/Low-High  Mission 
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0-1  Taxi  and  take-off 

1- 2  Climb  to  30,000  ft.  cruise  altitude 

2- 3  Cruise  at  0.75  Mach  for  353  NM  to  target  area 

3- 4  High  altitude  ordnance  delivery  on  target 

4- 5  Cruise  at  0.8  Mach  for  353  NM  to  descent  point 

5- 6  Descend  to  loiter  altitude 

6- 7  Loiter  at  0.27  Mach,  at  sea  level  for  20  minutes 

7- 8  Approach,  land  and  taxi  to  ramp 


Figure  5.2  Generic  High-High/High-High  Mission 
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air  support/tactical  interdiction,  surface  combatant  de¬ 
struction,  armed  reconnaissance  and  defense  suppression. 

Of  the  missions  mentioned,  the  close  air  support/ 
tactical  interdiction  mission  was  selected  for  case  study 
evaluation.  This  mission  requires  the  aircraft  to  be 
exposed  to  surface  and  air  threats  from  either  sea  or  land 
based  systems.  The  RFP  requires  an  assessment  from  both  sea 
and  land  based  operating  theaters.  The  spectrum  of  threats 
that  the  A-20  could  be  exposed  to  covers  the  majority  of 
the  Soviet  naval  and  cities  defense  inventory. 

Specific  missions  as  conceived  by  the  author  can  be 
seen  in  Figures  5.3  and  5.4.  The  aircraft  can  be  deployed 
from  either  sea  or  land  based  assets  and  can  fly  the 
mission  profile  as  depicted  to  either  high  or  low  level 
ordnance  delivery,  depending  upon  mission  requirements. 

This  case  study  will  examine  the  threats  expected  in  the 
low  level  scenario. 

The  A-20  leaves  it  base  of  operations  (either  carrier 
for  USN  or  land  for  USAF)  and  proceeds  to  fly  the  high- 
low/low-high  mission.  Figure  5.3  shows  the  combat  radius 
to  be  approximately  300  NM.  This  mission  assumes  no 
external  tanks  or  in-flight  refueling. 

The  tactics  conceived  for  an  attack  mission  of  this 
type  are  those  which  are  characteristic  of  attack  aircraft 
currently  in  the  US  inventory.  Depending  on  the  ordnance 
to  be  delivered,  these  tactics  could  encompass  a  low 
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Figure  5.3 


A-20  High-Low/Low-High  Mission 
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CATAPAULT  LAUNCH 


ENEMY  A/C 


Figure  5.4  A-20  High-High/High-High  Mission 


altitude  evasive  ingress  and  pop-up  ordnance  delivery  (for 
bombs  and  cruise  missiles  stored  in  the  weapons  bay--see 
Figure  5.5),  a  straight-in  high  speed  strafing  run 
(utilizing  the  20  mm  cannon),  or  a  j inking-maneuvering  air- 
to-air  scenario  utilizing  the  sidewinders  (situated  on  the 
external  stations) . 

B.  THREAT  ANALYSIS 

Because  of  the  conceived  design  versatility  of  the  A- 
20,  the  threats  it  could  encounter  in  a  hostile  environment 
encompass  the  majority  of  Soviet  SAM/AAA  arsenal.  Over 
land,  the  A-20  could  encounter  anything  from  a  ZSU-23-4 
"Shilka"  to  an  SA-7  or  SA-9  site.  At  sea  the  threats  are 
just  as  numerous;  the  A-20  could  anticipate  encounter 
conditions  with  76  mm  AAA  or  any  one  of  the  SAN  systems. 

Because  this  case  study  is  using  the  close  air  sup¬ 
port/tactical  interdiction  mission  for  an  analysis,  the 
threat  to  be  assessed  is  narrowed  down  to  the  following 
representative,  generic,  system: 

(1)  SA-X,  a  generic  IR  homing  missile.  The  fragment 
size  is  100  grains  for  analysis. 

This  threat  was  chosen  because  of  its  utility  against 
low  level  targets  and  its  strategic  importance  to  the 
Soviet  defense  plan.  This  assessment  will  determine  the 
single  hit  vulnerability  values  of  the  A-20  for  this  threat 
propagator  based  on  engineering  evaluations  of  the 
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WINGS  LEVEL 


i 


Figure  5.5  A-20  Conceptual  Tactics 
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conceptual/preliminary  design.  Specifically,  the  component 
and  aircraft  probabilities  of  kill  given  a  hit,  the 
component  and  aircraft  probabilities  of  survival  given  a 
hit,  and  the  component  and  aircraft  vulnerable  areas. 
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VI.  A-20  FLIGHT  AND  MISSION  ESSENTIAL  FUNCTIONS 


The  methodology  for  this  task  is  found  in  both  Chapter 
2  and  Chapter  5  of  Ball  [Ref.  2].  In  Chapter  2,  pages  39- 
60,  Ball  discusses  a  tactical  aircraft  and  its  systems  in 
detail  to  help  the  reader  learn  the  major  components  and 
their  importance.  In  Chapter  5,  pages  138-140,  Ball 
presents  the  methodology  to  conduct  the  Flight  and  Mission 
Essential  Function  portion  of  the  analysis. 

Flight  and  Mission  Essential  Functions  are  those 
functions  that  must  be  properly  performed  in  order  for  the 
aircraft  to  complete  its  mission.  These  functions  are  also 
known  as  "critical"  functions.  They  are  functions  that 
must  be  performed  by  each  of  the  aircraft's  systems,  sub¬ 
systems  and  components  to  meet  the  survival  requirements  of 
each  applicable  kill  category;  either  conventional  attri¬ 
tion  or  mission  abort.  The  kill  category  selected  for  this 
case  study  is  the  attrition  kill.  The  attrition  kill  is  a 
measure  of  the  degree  of  aircraft  damage  which  renders  it 
incapable  of  continued  conventional  flight.  This  results 
in  a  crash  with  damage  beyond  that  of  economic  repair,  and 
a  loss  of  the  aircraft  from  the  inventory.  The  level  of 
attrition  kill  selected  for  analysis  is  the  "5  minute  A- 
level  kill"  as  described  by  Ball  [Ref.  2:p.  136]. 
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Required  mission  functions  are  those  necessary  to 
conduct  the  missions  determined  by  the  Mission  Threat 
Analysis  in  the  previous  chapter.  These  missions  can  be 
divided  into  separate  and  distinct  phases  in  order  to 
determine  which  subsystem  contributes  to  a  mission 
essential  function,  a  flight  essential  function  (such  as 
Lift,  Thrust  or  Control) ,  or  both.  There  are  several 
phases  common  to  all  the  missions  discussed.  They  are: 

(1)  mission  planning 

(2)  man  up/take  off 

(3)  rendezvous,  climb  to  cruise  altitude 

(4)  fly  tactical  profile 

(5)  rendezvous,  climb  to  cruise  altitude 

(6)  descend  to  marshall/begin  approach 

(7)  carrier  arrestment/land 

From  the  case  study  standpoint,  the  most  critical  phase 
of  the  analysis  is  phase  four,  the  tactical  profile  phase. 
The  aircraft  must  be  able  to  fly  and  perform  its  designed 
tactical  mission  of  delivering  ordnance  during  this  phase. 
Since  the  methodology  is  the  same  for  all  seven  phases, 
only  that  involving  phase  four  will  be  demonstrated.  Phase 
four  may  be  further  broken  down  into  subphases  to  deter¬ 
mine  subsystem  contributions. 

(4)  Fly  Tactical  Profile 

- subphases - 

-descend  to  ingress  point 

-descend  to  tactical  low  level  altitude,  commence 
evasive  flight  profile 
-search  and  acquire  target 

-perform  tactical  weapons  delivery  maneuver 
-weapons  release 

-resume  evasive  flight  profile  to  egress  point 
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For  case  study  purposes,  the  aircraft  is  composed  of  a 
number  of  systems  that  can  be  broken  down  into  various 
subsystems  that  affect  its  ability  to  fly  in  a  controlled 
flight  environment  and  to  conduct  and  complete  its  mission 
[Ref.  2:pp.  39-60].  Table  6.1  shows  the  aircraft  broken 
down  into  various  systems  and  subsystems  with  the  functions 
of  each  listed. 

Using  the  subphases  determined  from  the  mission  profile 
phase  and  the  systems  and  subsystems  (and  their  functions) 
as  noted  in  Table  6.1,  a  table  or  matrix  is  developed  to 
show  which  systems  are  required  during  each  subphase  of  the 
tactical  profile.  Table  6.2  is  a  summary  of  the  final 
analysis  of  the  Mission  and  Flight  Essential  Functions  for 
the  tactical  profile  phase  of  the  overall  mission.  For 
this  table,  each  function  of  the  system  and  subsystem  was 
evaluated  to  determine  its  participation  in  the  success  of 
the  overall  phase.  As  can  be  seen,  some  systems  and  sub¬ 
systems  contribute  to  both  the  flight  and  mission  success 
of  the  phase;  while  others,  such  as  the  avionics,  contrib¬ 
ute  to  only  the  mission  portion  of  the  tactical  profile 
phase . 

This  method  of  analysis  is  done  for  each  one  of  the 
mission  phases.  This  analysis  of  which  systems  and 
subsystems  provide  the  essential  functions  is  the  first 
step  in  determining  each  system's  and  subsystem's  critical 
components.  Now  that  this  chapter  has  presented  the 
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TABLE  6.1  SYSTEMS/SUBSYSTEMS  AND  FUNCTIONS 


System/Subsystem 

Function 

Pilot 

Maintain  aircraft  control 

Engines 

Compressors 

Combustors 

Turbines 

Fuel  Controls 

Hydraulics 

Oil  Systems 

Electrical  Systems 

Mounts 

Provide  and/or  maintain 
required  thrust 

Accessory  Drives 

Provide  power  for  acces¬ 
sories 

Throttle  Control  Subsystem 

Provide  control  of  engine 
power  output. 

Mechanical  Flight  Controls 
Longitudinal  Linkages 
Lateral  Linkages 

Control  Stick 

Provide  complete  mechanical 
back-up  control  in  case  of 
Automatic  Flight  Controls 
failure.  Provide  pilot  in¬ 
put  to  control  surfaces. 

Automatic  Flight  Controls 
Flight  Control  Computers 
Flight  Control  Surfaces 

Rate  Sensors 

Air  Data  Sensors 

Stick  Force  Sensors 
Accelerometers 

Rudder  Pedal  Transducers 
Direct  Electrical  Link 

Provide  electrical  signals 
to  all  flight  control  sur¬ 
faces  . 

Electrical  System 

Provide  electrical  power 
during  all  flight  phases. 

Fuel  System 

Tanks 

Lines 

Pumps 

Store  and  deliver  fuel  to 
engines . 
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TABLE  6.1  (cont.)  SYSTEMS/SUBSYSTEMS  AND  FUNCTIONS 


System/Subsystem 

Function 

Hydraulic  Subsystems 
Reservoirs 

Accumulators 

Lines 

Pumps 

Manifolds 

Filters  and  Coolers 

Primary  Actuators 

Provide  hydraulic  power  from 
at  least  one  system  to  move 
primary  control  surfaces, 
weapons  bay  door  actuators, 
cannon,  landing  gear,  etc. . 

Structures 

Control  Surface  and 

Wing  Attach  Fittings 

Spar  Caps 

Control  Surface  and 

Wing  Attach  Points 

Carry  structural  loads  and 
provide  for  structural 
integrity  of  the  aircraft. 

Air  Conditioning  Subsystem 

Provide  required  air  condi¬ 
tioning  for  selected  com¬ 
ponents  . 

Airborne  Weapons  Control 
Components 

Provide  airborne  weapons 
control  and  monitoring. 

Communication  and 

Identification  Components 

Provide  communication  and 
identification . 

Electronic  Warfare 

Components 

Provide  ECM  capabilities. 

TACAN 

Provide  navigation  capability 

Mission  Computers 

Provide  data  processing 
capability . 

Instrument  Panels 

Provide  pilot  monitoring  and 
control  of  subsystems. 

Displays 

Radar 

Display  information 

Air  Data  Equipment 

Acquire,  process  and 
display  air  speed  and  angle- 
of-attack  information. 
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mission  fit  =  flight  b/u  =  backup  Tactical  Profile  Subphases 
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TABLE  6.2  (cont.) 

TACTICAL  PROFILE  PHASE  —  FLIGHT  AHD  MISSION  ESSENTIAL  FUNCTION  S( 
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flight  and  mission  essential  functions  methodology  of  the 
A-20,  the  next  chapter  will  provide  the  Failure  Mode,  Ef¬ 
fects  and  Criticality  Analysis  (FMECA)  for  the  aircraft. 
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VII.  A-20  FAILURE  MODE.  EFFECTS.  AND  CRITICALITY  ANALYSIS 

The  methodology  for  the  Failure  Mode,  Effects,  and 
Criticality  Analysis  (FMECA)  is  presented  by  Ball  [Ref.  2] 
in  Chapter  Five.  The  FMECA  is  broken  down  into  two  parts, 
a  Failure  Modes  and  Effects  Analysis  (FMEA)  and  a  Damage 
Modes  and  Effects  Analysis  (DMEA) .  Also  included  in  this 
section  (but  not  actually  part  of  the  FMECA  as  required  by 
MILSTD  2069) ,  is  a  Fault  Tree  Analysis  (FTA) .  The  FTA 
is  an  alternate,  and  very  effective,  approach  to  identi¬ 
fying  the  critical  components  of  a  system.  Each  of  these 
tasks  will  be  applied  to  the  aircraft  using  the  method¬ 
ology  found  on  pages  138-153  of  Ball  [Ref.  2]. 

A.  A-20  FAILURE  MODE  AND  EFFECTS  ANALYSIS  (FMEA) 

When  a  survivability  analysis  is  conducted  on  a  design, 
the  FMEA  is  normally  provided  by  engineers  who  are  concern¬ 
ed  with  system  safety,  reliability  and  maintainability.  It 
is  based  on  design  requirements,  historical  data  (if  the 
system  is  still  in  concept  stage) ,  predicted  performance 
measurements  and  sound  engineering  judgement.  This  analysis 
is  not  concerned  with  the  cause,  but  with  the  effect.  The 
FMEA  for  this  case  study  is  presented  in  two  parts:  (1)  the 
systems  descriptions  and  (2)  the  results  of  the  analysis  in 
tabular  format. 
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The  major  input  to  the  FMEA  is  the  physical  and  func¬ 
tional  description  of  the  aircraft  and  its  subsystems  and 
the  data  obtained  from  the  Flight  and  Mission  Essential 
Functions  Analysis.  For  an  aircraft  in  the  conceptual/pre¬ 
liminary  design  phase,  this  consists  of  conceptual  drawings 
and  narrative  descriptions  of  what  the  designer  thinks  the 
aircraft  should  look  like  and  be  capable  of. 

The  FMEA  is  usually  a  single  component  failure  analy¬ 
sis.  It  is  a  procedure  that  does  not  look  at  the  cause  of 
failure,  but  at  the  component  failure  itself  and  its  effect 
upon  the  system;  i.e.,  can  it  (the  subsystem  and  system) 
still  perform  its  essential  functions  with  this  component 
damaged.  In  other  words,  how  does  the  failure  of  the  com¬ 
ponent  affect  the  subsystems  operating  ability;  which  in 
turn  affects  the  systems  operating  ability. 

The  FMEA  for  this  case  study  is  presented  below  in  two 
parts:  (1)  the  systems  descriptions  and  (2)  the  results  of 
the  analysis  in  tabular  format. 

1 .  Systems  Descriptions 

Conceptual  drawings  (see  Figures  7.1  through  7.6) 
and  a  brief  description  of  the  Fuel,  Hydraulics,  Flight 
Controls,  Propulsion,  Armament  and  Structural  Systems  of 
the  case  study  aircraft  follows.  These  subsystems  were 
chosen  for  analysis  because  they  are  the  major  subsystems 
of  the  aircraft  and  are  well  developed  in  the  conceptual/ 
preliminary  design  phase.  Also,  each  of  these  subsystems 
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has  an  affect  on  the  ability  of  the  aircraft  to  perform  its 
essential  functions  in  the  tactical  subphase  (as  determined 
in  the  Flight  and  Mission  Essential  Functions  analysis) . 
a.  The  Fuel  System 

The  A-20  fuel  system  consists  of  fuel  storage 
and  transfer  tanks,  plumbing,  on  board  and  in-flight  fuel¬ 
ing  and  refueling  devices,  and  associated  filters  and 
pressurization  system.  As  seen  in  Figure  7.1,  there  are 
six  internal  tanks:  four  fuselage  tanks,  and  two  integral 
wing  tanks.  In  addition,  there  is  a  vent  tank  located  in 
each  vertical  stabilizer.  The  A-20  also  has  the  capability 
to  carry  a  centerline  mounted  external  fuselage  tank. 

The  internal  fuel  system  is  designed  to  carry 
10,400  pounds  of  fuel.  The  two  fuselage  tanks  located 
longitudinally  along  either  side  of  the  weapons  bay  serve 
as  transfer  tanks.  The  integral  wing  tanks  also  serve  as 
transfer  tanks.  The  aft  fuselage  tank,  located  in  the 
underside  of  the  aircraft,  is  also  a  transfer  tank,  but  can 
be  switched  to  a  feed  tank  for  either  engine  if  necessary. 
The  forward  fuselage  tank  is  the  primary  feed  to  both  of 
the  engines  with  each  engine  having  a  separate  feed  line 
from  this  tank.  This  tank  is  non-transferable  and  carries 
the  "get-home"  fuel.  The  forward  and  aft  tanks  are  both 
self  sealing.  All  tanks  have  fire/explosion  suppresion 
foam  installed  in  the  ullage.  The  vent  tanks  in  the  verti¬ 
cal  tails  are  designed  to  collect  fuel  that  happens  to  get 
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Figure  7.1  A-20  Fuel  System 


73 


into  the  venting  lines  during  high  "g"  maneuvers.  It  is 
collected  in  these  tanks  and  gravity  fed  back  into  the  fuel 
system. 

As  with  most  Navy  fuel  systems,  fuel  transfer 
is  accomplished  by  motive  flow,  thus  eliminating  the  need 
for  electrical  power  to  feed  the  engines.  The  transfer 
system  can  automatically  sequence  fuel  to  keep  the  feed 
tanks  full  for  maximum  engine  performance;  or  the  pilot  can 
select  fuel  transfer  manually  under  failure  conditions. 

The  automatic  transfer  is  designed  to  take  into  account 
weapons  release  and  burned  fuel  to  maintain  a  relatively 
constant  center  of  gravity  location  through  all  flight 
regimes . 

As  can  be  seen  from  Figure  7.1,  the  majority  of 
the  plumbing  for  the  fuel  system  is  within  the  tanks,  help¬ 
ing  to  eliminate  excess  exposed  surface  area.  The  motive 
flow  and  boost  pumps  are  driven  off  the  accessories  sec¬ 
tion.  Boost  and  motive  flow  pumps  are  both  three  stage, 
single  shaft  pumps.  These  pumps  operate  by  the  venturi 
principle  with  regards  to  pressure  and  flow  rates, 
b.  The  Hydraulic  System 

The  hydraulic  system  supplies  hydraulic  power 
to  all  flight  control  surfaces,  the  landing  gear  brakes, 
the  cannon  drive,  the  weapons  bay  doors,  the  landing  gear 
mechanism,  and  the  nose  wheel  steering. 
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The  hydraulic  system,  shown  in  Figure  7.2,  con¬ 
sists  of  two  independent  hydraulic  systems  with  two  inde¬ 
pendent  circuits  in  each  system.  There  are  three  hydraulic 
reservoirs;  one  is  always  in  backup  for  the  other  two. 

Each  system  is  driven  by  an  engine  driven  pump  with  elec¬ 
trical  backup  at  a  pressure  of  3000  psi.  Each  system  is 
capable  of  supplying  hydraulic  power  to  all  flight  con¬ 
trol  surfaces.  The  systems  are  monitored  constantly  by  a 
control  network  for  correct  pressure  and  flow.  The  system 
can  direct  flow  through  one  circuit  while  cutting  off  the 
flow  in  another.  The  control  network  can  shut  off  one 
hydraulic  system  with  automatic  switching  that  is  dependent 
on  system  pressure  and  flow  rate.  If  the  pressure  in  one 
system  drops  below  1200  psi.,  flow  to  this  system  is  cut 
off  and  the  backup  reservoir  comes  on  line  to  that  system, 
c.  The  Flight  Control  System 

The  flight  control  system  of  the  A-20  is  shown 
in  Figure  7.3.  It  is  actually  three  independent  control 
systems,  two  electrical  and  one  mechanical.  There  is  an  on 
board  Automatic  Flight  Control  System  (AFCS) ,  with  a  separ¬ 
ate  circuit  for  each  one  of  the  two  flight  control  compu¬ 
ters.  The  flight  control  computers  are  located  in  the 
forward  electronics  bay,  just  aft  of  the  radome,  and  in  the 
aft  electronics  bay,  behind  the  cockpit.  All  control  sur¬ 
faces  can  be  controlled  by  any  one  of  the  three  systems. 
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In  normal  operation,  all  control  responses  are 
due  to  electrical  transmissions  received  from  control  stick 
and  rudder  inputs.  At  the  same  time  stick  and  rudder  pedal 
inputs  are  mechanically  backed  up  through  standard  pulleys 
and  linkages.  All  control  surface  movements  come  from  hy¬ 
draulic  boost  response  to  electrical  or  mechanical  inputs. 
In  the  event  of  a  hydraulic  problem,  the  mechanical  system 
can  control  the  airplane  without  the  boost  system. 

The  aircraft  is  controlled  in  all  three  axis  by 
the  two  flight  control  computers  equipped  with  their  own 
accelerometers,  rate  sensors,  stick  force  and  rudder  pedal 
transducer  inputs.  Each  computer  has  two  channels,  and 
each  has  the  capacity  to  process  all  inputs  and  perform  all 
necessary  computations  to  fly  the  aircraft.  In  effect, 
there  is  multiple  redundancy  in  the  flight  control  system 
with  both  electrical  and  mechanical  backups, 
d.  The  Propulsion  System 

The  propulsion  system  proposed  for  the  A-20  is 
of  1990's  technology.  It  is  powered  by  a  derivative  of 
current  development  engines.  The  thrust  capability  of 
these  engines  is  20,000  pounds  thrust  per  engine  in  maximum 
afterburner  at  sea  level. 

As  shown  in  Figure  7.4,  the  propulsion  system 
has  a  unique  intake  arrangement.  Designed  with  surviv¬ 
ability  in  mind,  the  intake  wraps  around  the  top  of  the 
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fuselage,  with  the  wings  adding  protection  against  projec¬ 
tile  penetration. 

The  design  engine  in  the  A-20  is  a  low  by-pass 
turbo  fan  engine.  A  three  stage  fan  and  an  eight  stage 
compressor  are  each  driven  by  a  single  stage  turbine.  •  The 
compressor  is  of  variable  geometry  with  continuous  by-pass 
from  the  fan  to  the  augmentation  section.  There  is  no 
acceleration  bleed  system  required  for  the  engine. 

For  combustion,  the  engine  is  equipped  with  a 
flow  through  annular  type  combustor  utilizing  eight  combus¬ 
tion  cans  each  of  which  has  four  atomizing  fuel  nozzles. 

The  burning  gases  are  directed  rearward  through  a  single 
stage  turbine  which  drives  the  fan  and  the  high  pressure 
rotors . 

Augmentation  is  continuous  and  in  all  ranges  of 
operation.  The  afterburner  operates  with  injected  fuel 
through  six  manifolds  located  in  the  exhaust  core  and  fan 
discharge  stream.  Ignition  is  caused  by  a  fuel  rich 
mixture  torching  through  the  turbine  stage  to  the  manifold 
and  flame  holder.  Fan  discharge  air  cools  the  after  burner 
liner  in  the  duct  and  and  helps  maintain  a  low  exterior 
skin  temperature  on  the  engine  covers.  The  variable  area 
nozzle  is  hydraulically  actuated  with  its  own  hydraulic 
system. 

Each  engine  is  independently  controlled  with 
single  throttle  actuation  by  the  pilot.  The  engine  control 
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then  programs  the  variable  nozzle  area,  temperature  levels, 
turbine  speeds  and  correct  fuel  flow  for  proper  and  effi¬ 
cient  operation. 

The  lubrication  system  is  self  contained  for 
each  engine.  The  capacity  of  the  system  is  4.5  gallons,  of 
which  4.0  is  useable.  The  bearing  system  is  composed  of 
three  bearings  for  the  fan  rotor  and  two  bearings  for  the 
high  pressure  rotor.  The  low  pressure  rotor  bearings 
support  the  fan  forward  on  the  front  frame,  aft  on  the  mid 
frame,  and  the  aft  end  of  the  fan  turbine  in  the  turbine 
frame . 

The  high  pressure  rotor  is  supported  by  a 
thrust  bearing  at  the  forward  end  in  the  mid  frame  and  by  a 
differential  bearing  at  the  aft  end  of  the  turbine  with  the 
fan  rotor. 

Electrical  power  for  engine  start  and  electri¬ 
cal  control  is  supplied  by  the  alternator.  Ignition  is 
automatic  depending  on  the  system  requirements. 

The  accessory  gearbox  drives  one  level  of 
hydraulic  power,  the  electrical  generators  and  other 
miscellaneous  uses.  Bleed  air  from  high  and  low  stage 
compressors  is  utilized  for  auxiliary  equipment  operation 
such  as  engine  anti-ice  and  the  environmental  control 
system. 
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e.  The  Armament  System 

The  Armament  System  is  shown  in  Figure  7.5. 

The  design  of  the  A-20  incorporates  a  weapons  bay. 

Tradeoff  studies  revealed  that  the  aircraft,  with  its 
unique  intake  system,  needed  the  majority  of  the  stores  to 
be  internal  to  sustain  efficient  high  speed  operations. 

The  A-20  is  a  heavily  armed  aircraft.  There 
are  four  sidewinder  missile  mounts  on  the  exterior;  one  on 
each  wing  tip  and  one  each  at  the  fuselage  and  wing 
underside  junction. 

The  weapons  bay  has  the  capacity  to  carry 
either  four  cruise  missiles  or  a  combination  of  bombs/mis¬ 
siles  with  a  total  interior  weapons  load  weight  of  6,500 
pounds.  The  weapons  bay  doors  are  both  hydraulically  and 
electrically  actuated,  and  fold  into  themselves  for  drag 
reduction. 

Mounted  on  the  left  hand  interior  of  the  fuse¬ 
lage,  adjacent  to  the  cockpit,  is  a  20  mm  cannon  with  a 
capacity  of  2,000  rounds  per  minute. 

All  weapons  selection  controls  are  on  the 
pilot's  control  stick  and  throttle  controls,  giving  him  the 
capability  to  select,  arm,  and  fire  the  weapon  without  ever 
taking  his  hands  off  the  primary  controls. 
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f.  The  Structural  System 

The  A-20  structure  groups  (Figure  7.6)  are  the 
nose  radome,  the  weapons  bay,  the  crew  station,  the  forward 
fuselage,  the  center  fuselage,  the  aft  fuselage,  the  in¬ 
board  wing  section, 'the  outboard  wing  section,  the  vertical 
stabilizers  and  the  horizontal  stabilators. 

The  nose  radome  provides  an  electronically 
transparent  window  for  radar  transmissions.  It  is  a  struc¬ 
tural  member,  housing  the  forward  avionics  bay  and  semi- 
monocoque  in  construction. 

The  crew  station  is  directly  aft  of  the  radome 
section.  It  has  a  canopy  enclosed  cockpit  and  provides  an 
oxygen  environment  for  the  pilot.  All  pilot  controls  and 
features  are  in  the  cockpit.  There  is  an  ejection  seat, 
center  mounted  control  stick  and  side  mounted  throttles. 

The  pilot  can  control  all  flight  mission  essential  systems 
from  these  control  mounts. 

The  weapons  bay  is  located  beneath  and  aft  of 
the  cockpit,  one  third  of  the  distance  along  the  length  of 
the  fuselage.  It  consists  of  a  cavity  large  enough  to 
carry  four  cruise  missiles  twelve  feet  in  length.  It  is 
convertible  to  other  types  of  ordnance.  The  weapons  bay  in 
itself  is  a  structural  member,  built  as  one  unit  to  be 
installed  in  the  fuselage. 
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Figure  7.6  A-20  Structural  System 
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The  forward  fuselage  is  conventionally  con¬ 
structed  with  multi-stiffened  longerons  and  is  semi- 
monocoque.  It  is  strengthened  for  a  20  mm  cannon  located 
adjacent  to  the  pilot  on  the  port  side.  It  provides  a 
structural  bulkhead  for  the  forward  avionics  bay  and  com¬ 
pletely  supports  the  aft  bay.  It  also  provides  attachment 
bulkheads  for  the  forward  portion  of  the  weapons  bay  and 
the  forward  fuselage  fuel  tank.  Structurally,  the  forward 
fuselage  has  major  longerons,  shear  webs,  bulkheads  and 
floors.  It  is  compartmented  for  strength  and  ease  of 
maintenance . 

The  center  fuselage  carries  the  wrap  around 
intake  system,  the  forward  fuselage  transfer  tank,  the  wing 
carry  through  box,  roots,  and  wing  attachment  points.  It 
also  has  the  main  landing  gear  supports,  assorted  struc¬ 
tural  members,  and  the  aft  mounting  bulkhead  for  the 
weapons  bay.  The  backup  hydraulic  reservoir  and  pump  are 
located  on  the  starboard  side  and  there  is  also  fuselage 
mounted  sidewinder  stations  beneath  the  wing. 

The  aft  fuselage  consists  of  the  engine  bay 
cavities,  a  longitudinal  alloyed  bulkhead  between  the  en¬ 
gines,  horizontal  stabilator  attachments,  vertical  stabil¬ 
izer  attachments,  tail  hook  and  speed  brake  assembly.  Also 
the  primary  hydraulic  reservoirs  are  located  adjacent  to 
the  engine  accessory  drives. 
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The  inboard  wing  consists  of  the  wing  box,  wing 
root,  and  integral  fuel  tank.  There  is  a  three  cell  torque 
box  and  the  flap  structure.  The  leading  edge  is  extendable 
with  the  necessary  hydraulic  and  electrical  equipment 
located  within.  The  wing  spars  and  ribs  are  all  machined 
and  cast  aluminum.  The  skin  is  both  aluminum  and  graphite 
epoxy  composites. 

The  outboard  wing  section  consists  of  a 
multispar,  multibox  structure  which  extends  from  the  'fold 
joint  to  the  wing  tip.  There  is  no  fuel  in  this  section, 
but  it  does  have  an  outboard  sidewinder  installation  pod 
located  on  the  tip.  There  is  also  the  remaining  leading 
edge  extension  plumbing  and  an  aileron  which  extends  along 
the  entire  outboard  section.  The  materials  used  in  this 
section  are  primarily  graphite  epoxy  for  the  skin  and  cast 
aluminum  for  the  spars. 

The  vertical  stabilizers  are  mounted  with  an 
eighty  one  degree  dihedral  on  the  aft  fuselage  assembly. 
They  carry  the  vent  tanks  and  navigation  lights  and  consist 
of  three  spars  and  four  box  beams.  The  skin  covering  is 
aluminum  and  fiberglass.  The  moving  control  surfaces  are 
made  from  graphite  epoxy  composites. 

The  horizontal  stabilators  are  constructed 
entirely  of  graphite  epoxy  composites  and  fiberglass.  They 
have  a  honey  combed  interior  and  rotate  upon  a  titanium  al¬ 
loy  hub. 
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As  can  be  seen  from  the  preceeding  figures  and 
discussion,  the  A-20  was  designed  for  ease  of  major  main¬ 
tenance  and  combat  damage  repair. 

2 .  Analysis  Results 

Consistent  with  the  format  previously  established, 
the  fuel  system  will  be  the  only  system  broken  down  into 
detail  and  analyzed  using  the  FMEA  methodology  to  produce 
the  final  product,  Table  7.1,  the  FMEA  Matrix. 

The  fuel  system  components  have  been  analyzed  to 
determine  how  they  could  fail  and  what  effect  this  failure 
has  on  the  system.  Results  of  the  FMEA  analysis  performed 
on  the  fuel  system  are  shown  in  Table  7.1.  The  most 
important  result  of  this  analysis  is  the  input  it  provides 
to  the  preparation  of  the  list  of  critical  components, 
which  is  the  output  of  the  assessment. 

B.  A-20  DAMAGE  MODE  EFFECTS  AND  ANALYSIS  (DMEA) 

The  DMEA  is  dependent  upon  the  kill  criteria  and  the 
threat.  It  relates  potential  failures  such  as  those  de¬ 
termined  in  the  FMEA,  with  the  threat  weapons  and  their 
damage  mechanisms.  It  also  associates  the  effects  of  the 
failures  to  the  kill  criterion,  redundancy  and  flight  con¬ 
ditions  and  provides  the  checklist  for  the  final  determin¬ 
ation  of  critical  components  and  their  redundancy 
relationships . 
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TABI-E  7.1  (cont.)  FAILURE  MCDES  AID  EFFECTS  ANALYSIS 
A-20  FUEL  SYSTEM 
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TABLE  7.1  (cont.)  FAILURE  MODES  AND  EFFE-CTS  ANALYSIS 
A-20  FUEL  SYSTEM 
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TABLE  7.1  (cont.)  FAILURE  MODES  AID  EFFECTS  ANALYSIS 
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TABLE  7.1  (cont.)  FAILURE  MCDES  AM)  EFFECTS  ANALYSIS 
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Normally  a  DMEA  is  comprised  of  four  sets  of  ouput 
data:  (1)  The  DMEA  Tables,  (2)  The  Disablement  Diagrams, 

(3)  The  Kill  (or  Fault)  Trees  or  Kill  Diagrams  and  (4)  The 
P(k/h)  Functions.  In  this  case  study  all  four  of  these 
data  will  be  presented.  A  Fault  Tree  Analysis  is  also 
included  in  this  section.  As  mentioned  earlier,  this,  is 
not  required  by  MILSTD  2069  [Ref.  1] .  It  is  being 
presented  here  because  it  is  an  alternate  and  extremely 
effective  method  of  component  identification. 

Since  the  FTA  is  being  used  in  this  analysis,  the 
presentation  of  DMEA  results  will  be  in  a  different  order 
than  defined  by  MILSTD  2069  [Ref.  1]. 

The  results  will  be  presented  as  follows:  The  DMEA 
Tables  and  The  Disablement  Diagrams  are  developed  for  the 
fuel  system  only;  following  the  routine  established  in 
earlier  sections.  The  FTA  is  presented  next  not  only  for 
the  fuel  system,  but  for  the  entire  aircraft.  This  is  done 
to  show  how  effective  the  FTA  is  and  to  show  that  the  depth 
of  analysis  makes  it  an  excellent  alternative  to  the  FMEA. 
The  list  of  critical  components  is  presented  in  conjunction 
with  the  FTA.  This  was  done  to  show  how  this  list  is  the 
logical  result  and  product  of  the  FMEA,  DMEA  Tables, 
Disablement  Diagrams  and  FTA.  The  Kill  Tree  is  presented 
next.  This  is  also  created  for  the  entire  aircraft,  giving 
a  visual  presentation  of  the  critical  components  and 
redundancy  relationships  The  final  data  presented  are 
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P(k/h)  Functions.  They  are  presented  in  conjunction  with  a 
representative  list  of  critical  components  from  the  entire 
aircraft.  •  This  part  of  the  assessment  is  presented  last  to 
allow  for  input  to  the  list  from  every  possible  source  of 
analysis . 

According  to  MILSTD  2069  [Ref.  l:p.  15],  the  list  of 
critical  components  is  complete  after  creating  the  DMEA 
Matrix.  By  performing  the  analysis  of  the  A-20  in  the 
order  discussed,  the  author  feels  a  more  complete  and 
thorough  list  of  critical  components  is  the  end  result. 

1 .  The  DMEA  Matrix 

The  DMEA  Matrix  for  the  Fuel  System  is  shown  in 
Table  7.2.  This  matrix  relates  the  components  and  their 
failure  modes  to  the  probability  of  kill  given  a  hit 
functions  (P(k/h)),  kill  criterion,  and  the  redundancy 
categories  in  a  tabular  format. 

As  seen  from  Table  7.2,  not  all  of  the  components 
of  the  fuel  system  are  considered  critical  for  the  level  of 
kill  being  analyzed  (A-level  attrition) .  This  is  one  goal 
of  the  DMEA,  to  determine  those  components  which  are 
critical  to  the  kill  level  of  the  aircraft.  Table  7.2 
shows  the  fuel  system  broken  down  into  sufficient  detail  to 
allow  an  evaluation  of  its  components  and  the  role  they 
play  in  the  provision  of  essential  functions. 

Table  7.3  explains  the  notes  found  in  the  remarks 
section  of  the  DMEA  Matrix.  This  is  a  clarification  of  the 
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TABLE  7.2  DAMAGE  MOOES  AID  EFFECTS  ANALYSIS 
A-20  FUEL  SYSTEM 


J3 

\ 


3 

*9  ^  w 

Eh  Cm  0) 
3 

(D  ^  rH 

o  o  ro 
co  u-i  > 


u  w 

0  £ 
u_i  O 

m  4J 

•  ro 
f-  C 


"9  S 

^  <U 
GJ  -u 
O  O 

w  c 


CN  VO 
I  I 
Cm  Lu 


CN  VO 
I  I 
tu  Cm 


a; 

u 

Cm 


'S 

ro 

N 

*0 


<u 

u 

Cm 


a 

X 


<D 

U 

♦H 

Cm 


c 

w 

o 

a 

X 

u 


.X  VO 

c  - 
ro  m 
Eh  1 
cm 

c 

2*8 
ro  O 
a  3 

w,s 

VM  (X 

"3  w 

CQ  *HH 


Qi 

CT> 

ro 

-X 

ro 

a 

$ 


<D 

CT» 

(0 

■S 

a> 

'a' 


<D 

ro 

■i 

0) 

$ 


QJ 

TO 

-X 

ro 

o 

32 


u 

O 

vu 

vu 

W 

<#> 

W 

<*> 

c 

<*> 

<*> 

O 

3 

c#> 

<*> 

O 

4J 

ro 

<*> 

O 

in 

o 

S3 

<*> 

O 

in 

O 

o>0 

-U  rH 

-3  (H 

u 

m 

in 

r- 

u 

in 

in 

r-'  <— t 

fo 

in 

J 

VU 

CT>r-i 

CN 

1 

1 

Eh 

CN 

i 

I 

1 

Eh 

CN 

E 

(1)  3 

♦jH  3 

1 

vo 

VO 

u 

l 

VO 

VO 

IM 

l 

J  VM 

(X  u-1 

•a 

<D 

o 

CN 

in 

r- 

0) 

o 

CN 

in 

r" 

lM 

0) 

o 

Cm 

1 

l 

TJ 

ro  jj  T3 

(D 

T3 

1  ,*T 

I  *r 

c 

4J  T3 

1— 1 

<— i 

C3T3 

1— 1 

r— 1 

i— I 

vu 

"3  hh 

■g> 

3  ^ 

vu 

ro 

CD 

CD 

o 

<D 

■*h  CT>  <0 

(U 

<D 

<D 

<L> 

W 

(0 

<D 

s 

Q 

3 

3 

3 

3 

'U  — (  ^ 

3 

3 

3 

3 

3 

3 

ro 

ro 

3 

3! 

33 

Cm 

Cm 

Cm 

Cm 

3  (X  22 

Cm 

Cm 

Cm 

Cm 

ro 

£2 

Cm 

Eh  <D 

Eh  <U 

-U 

1 

J-»  1 

u 

CQ 

rr> 

Eh 

| 

CT>  f0 

cr>  ro 

CT>  JX 

!T>  _X 

3  I"H 

C 

3 

C  3 

4J 

< 

o 

ro 

0  ro 

vu 

CH 

2  3 

2  3 

33 

rn 

33  Eh 

< 

98 


TABLE  7.2  (cont.)  DAMAGE  MOOES  AH)  EFFECTS  ANALYSIS 
A-20  FUEL  SYSTEM 
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TABLE  7.3  FUEL  SYSTEM  DMEA  NOTES 


F-l:  Component  not  critical  for  vulnerable  area 

calculations . 

F-2:  Location  adjacent  to  weapons  bay  makes  this  tank 

very  important  in  vulnerable  area  calculations. 

F-3:  Ullage  is  considered  only  when  tank  is  less  than 

50%  full. 

F-4:  Tank  has  "get  home"  fuel,  can  feed  both  engines 

if  necessary. 

F-5:  Tank  is  kept  full  by  auto-sequencing  of  fuel 

system. 

F-6:  Bladders  and  Tanks  themselves  are  not  considered 

critical  for  vulnerable  area  calculation. 

F-7 :  Lines  from  feed  tank  to  engines  are  redundant. 

Allows  feeding  of  both  engines. 

F-8:  Most  of  fuel  lines  are  internal  and  short  as  seen 

in  Figure  [7.1].  Rupture  of  line  will  not 
affect  flow  in  majority  of  system. 

F-9:  Each  wing  tank  has  two  paths  to  flow  to  engine. 

Can  direct  feed  is  necessary. 

F-10:  Either  vent  tank  capable  of  venting  system.  Vent 
hazard  is  small.  Area  is  not  considered  in 
vulnerable  area  calculation. 

F-ll:  Loss  of  both  pumps  results  in  fuel  starvation 
because  of  inability  to  transfer. 
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effect  the  damaged  component  has  on  the  system.  Notice 
that  several  of  the  remarks  refer  to  the  FMEA,  an  example 
of  the  interrelationship  between  the  types  of  assessment. 

2 .  The  Disablement  Diagram 

The  second  set  of  data  developed  in  the  DMEA  is  the 
Disablement  Diagram.  The  Disablement  Diagram  combines  both 
data  from  the  FMEA  and  DMEA  to  display: 

1.  The  physical  location  of  components  within  the 
system. 

2.  The  failure  mode  of  a  component. 

3.  The  effect  of  the  failure  on  the  subsystem  and  the 
aircraft . 

4.  The  resultant  aircraft  kill  criteria. 

Figure  7.7  show  the  Fuel  System  Disablement  Dia¬ 
grams.  The  components  and  subsytems  that  can  if  killed 
would  lead  to  an  attrition  kill  are  exhibited  graphically 
in  flow  chart  fashion.  Note  the  redundancy  in  the  motive 
flow  pumps  and  engine  driven  fuel  systems. 

3 .  The  Fault  Tree  Analysis  (FTA^ 

The  Fault  Tree  Analysis,  (the  output  of  which  is 
known  as  the  Fault  Tree  Diagram  or  Failure  Analysis  Logic 
Tree  {FALT}),  is  not  specifically  required  by  MILSTD  2069 
[Ref.  1]  as  a  means  of  determining  the  critical  components 
of  the  system.  However,  it  is  often  used  as  a  substitute 
for  the  FMEA  when  one  is  not  available.  Because  of  its  use 
as  one  of  the  principal  tools  of  system  safety,  reliability 
and  maintainability  analyses,  it  may  be  preferred  over  the 
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Figure  7.7  A-20  Fuel  System  Disablement  Diagram 
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Figure  7.7  (cont.) 


A-20  Fuel  System  Disablement  Diagram 
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Figure  7.7  (cont.)  A-20  Fuel  System  Disablement  Diagram 
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Figure  7.7  (cont.)  A-20  Fuel  System  Disablement  Diagram 


FMEA.  This  analysis  is  valuable  in  that  its  logic  and 
methodology  involves  development  of  a  system  hierarchy  in 
terms  of  a  specific  characteristic,  result  or  effect.  As 
such  it  can  take  into  account  both  hardware  failures  and 
human  effects. 

The  FTA  begins  with  an  undesired  event,  in  this 
case  study  an  A-level  attrition  kill.  It  then  logically 
determines  what  event  or  combination  of  events  (i.e., 
component  or  subsystem  failures  due  to  penetrator  damage) 
can  cause  the  undesired  event  to  occur. 

For  most  aircraft  FTA's,  attrition  is  caused  by  the 
inability  of  the  aircraft  to  fly  or  land.  For  the  A-level 
attrition,  only  the  inability  of  the  aircraft  to  fly  is 
analyzed.  The  assessment  then  logically  branches  down  into 
a  detailed  analysis  of  what  can  cause  the  attrition.  Ball 
[Ref.  2]  discusses  the  FTA  and  its  logic  symbology  on  pages 
149-151. 

Figure  7.8  and  Table  7.4  show  the  results  of  the 
Fault  Tree  Analysis  performed  on  the  A-20.  The  Fault  Tree 
Diagram  or  FALT  is  the  graphical  presentation  of  the 
analysis.  Figure  7.8  shows  the  aircraft  and  its  subsystems 
broken  down,  just  like  in  an  FMEA,  to  determine  how  the 
undesirable  event,  the  A-level  attrition,  can  occur. 
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A-2  0  Fault  Tree  Diagram 
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Figure  7.3  (cont.)  A-20  Fault  Tree  Diagram 
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Figure  7.8  (cont.) 
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Diagram 
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Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 


See  Al  next  page 
A2  and  A3  follow 


TABLE  7.4  A1  LEFT  ENGINE  FUEL  SYSTEM  FAILURE 

COMPONENT  LIST 


COMPONENT 


REDUNDANCY  DAMAGE 

RELATIONSHIP 


engine  driven  fuel  pump 

fuel  temperature  control 

fuel  control 

fuel  nozzles 

motive  flow  fuel  line 

fuel  line-feed  tank  to  engine 


R 

R 

R 

R 

R 

R 


swing  check  valve 


R 


firewall  shutoff  valve 


R 


penetration 
penetration 
penetration 
penetration 
penetrate/ sever 
penetrate/ sever 

penetration — 
three  for 
attrition 

penetration 
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Figure  7.8 


(cont . ) 


A-2 0  Fault  Tree  Diagram 


A21  next  page,  DRIVE  SHAFT 

irs  follow  in  OR  BEARING 

!rical  order  DAMAGE 


TABLE  7.4  (cont.) 


A21  LEFT  ENGINE  FAN  SECTION  DAMAGE 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY 

RELATIONSHIP 


DAMAGE 


case  R 
inlet  case  supports  R 
rotor  and  stator  blades  R 
front  accessory  support  R 


penetration 

penetration 

penetration 

penetration 


A22  LEFT  ENGINE  COMPRESSOR  DAMAGE 
COMPONENT  LIST 


COMPONENT 

REDUNDANCY 

RELATIONSHIP 

DAMAGE 

case 

R 

penetration 

LP 

rotor  and  stator 

blades 

R 

penetration 

HP 

rotor  and  stator 

blades 

R 

penetration 

LP 

compressor  hub 

R 

sever 

HP 

compressor  hub 

R 

sever 

A23  LEFT  DRIVE  SHAFT  AND  BEARING  DAMAGE 
COMPONENT  LIST 


COMPONENT 


LP  turbine/compressor  shaft 
HP  turbine/compressor  shaft 
forward  end  thrust  bearing 
aft  end  differential  bearing 


REDUNDANCY  DAMAGE 
RELATIONSHIP 

R  penetrate/sever 
R  penetrate/sever 
R  penetrate/sever 
R  penetrate 
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TABLE  7.4  (cont.) 


A24  LEFT  ENGINE  COMBUSTOR  DAMAGE 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY 

RELATIONSHIP 


DAMAGE 


outer  case  R 
inner  case  R 
combustion  chamber  duct  R 
bypass  duct  R 


penetration 

penetration 

penetration 

penetration 


A25  LEFT  ENGINE  TURBINE  DAMAGE 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY  DAMAGE 

RELATIONSHIP 


case  R 
hp  bypass  air  duct  R 
hp  bearing  supports  R 
hp  rotor  and  stator  blades  R 
lp  rotor  and  stator  blades  R 


penetration 

penetration 

penetrate/ sever 

sever 

sever 
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Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 
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TABLE  7.4  (cont.) 


A3 1  LEFT  ENGINE  OIL  SYSTEM  DAMAGE 
COMPONENT  LIST 


COMPONENT 

REDUNDANCY 

RELATIONSHIP 

DAMAGE 

scavenge  pump  drive  shaft 

R 

sever 

main 

gear  box 

R 

penetration 

lube 

oil  scavenge  pump 

R 

penetration/ 

starvation 

A3 2  LEFT 

ENGINE  SUPPORT  SYSTEM 
COMPONENT  LIST 

DAMAGE 

COMPONENT 

REDUNDANCY 

RELATIONSHIP 

DAMAGE 

inner  inlet  duct 

R 

penetration — 
fuel  ingestion 

engine  mount (s) 

forward 

mid 

rear 

R 

sever  2  or  more 
for  attrition 

throttle  actuator 

R 

sever/penetrate 

support  control  box 

R 

penetration 

bleed  control 

R 

penetration 
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Figure  7.8  (cont.)  A-20  Fault-  Tree  Diagram 
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TABLE  7.4  (cont.) 

Cl  LOSS  OF  LEFT  ENGINE  THROTTLE  CONTROL 
COMPONENT  LIST 

COMPONENT 

REDUNDANCY  DAMAGE 

RELATIONSHIP  ' 

throttle  control 

R  jam/ sever 
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Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 
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TABLE  7.4  (cont.)  El  LEFT  FUEL  SYSTEM  INOPERABLE 

COMPONENT  LIST 


COMPONENT 

REDUNDANCY 

RELATIONSHIP 

DAMAGE 

wing  tank 

NR 

fire/ explosion 

longitudinal  transfer  tank 

NR 

hydraulic  ram 

0-25% 

fuel 

NR 

fire/ explosion 

26-50% 

fuel 

NR 

fire/explosion 

forward  feed  tank 

NR 

hydraulic  ram 

aft  transfer  tank 

NR 

hydraulic  ram 

vent  tank 

NR 

structural  damage 

fuel  transfer  lines 

R 

puncture/ sever 

motive  flow  lines 

R 

puncture/sever 
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See  121  next  page  See  122  following  121 
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Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 
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See  Jl  on  next  page 


TABLE  7.4  (cont.)  J1  LOSS  OF  LEFT  WING 
COMPONENT  LIST 


COMPONENT  REDUNDANCY  DAMAGE 

RELATIONSHIP 


left  front  spar  cap 

R 

sever,  hydraulic 

left  aft  spar  cap 

R 

ram — must  lose 

left  #1  spar  cap 

R 

three  of  six  for 

left  #2  spar  cap 

R 

attrition 

left  #3  spar  cap 

R 

left  #4  spar  cap 

R 

left 

front  outboard  spar  cap 

R 

sever,  hydraulic 

left 

#1 

outboard  spar  cap 

R 

ram — must  lose 

left 

#2 

outboard  spar  cap 

R 

three  of  five  for 

left 

#3 

outboard  spar  cap 

R 

attrition 

left 

rear  outboard  spar  cap 

R 

TABLE  7.4  (cont.)  122  LOSS  OF  LONGITUDINAL  INTEGRITY 

COMPONENT  LIST 


COMPONENT 


REDUNDANCY 

RELATIONSHIP 


DAMAGE 


forward  upper  (2) 
forward  lower  (2) 


forward  aft  (2) 

center  upper  (2) 
center  lower  (2) 
center  keel  (2) 

aft  upper  (2) 
aft  side  (2) 
aft  keel  (2) 


R  sever — must  sever 

R  three  of  six  for 

R  attrition 

R  sever — must  sever 

R  three  of  six  for 

R  ^attrition 


R 

R 

R 


sever — must  sever 
three  of  six  for 
attrition 


Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 


See  131  next  page, 
132,133  follow  in  order 
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.8  (cont.)  A-20  Fault  Tree  Diagram 
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following  pages 


TABLE  7.4  (cont.)  K1  PILOT  INCAPACITATED 
COMPONENT  LIST 


COMPONENT 

REDUNDANCY 

RELATIONSHIP 

DAMAGE 

head 

NR 

penetration 

thorax 

NR 

penetration 

abdomen 

NR 

penetration 

pelvis 

NR 

penetration 

left  arm 

NR 

penetration 

left  leg 

NR 

penetration 

right  arm 

NR 

penetration 

right  leg 

NR 

penetration 

K2  WEAPONS  BAY  DETONATION 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY  DAMAGE 

RELATIONSHIP 


cannon  ammo  drum  NR  penetration 

penetration 
of  any  one 
of  the  eight 
can  cause 
attrition 


missile  warheads  (4) 
missile  rocket  motors  (4) 


R 

R 


TABLE  7.4  (cont.)  K3  CANOPY  FRAME  DAMAGE 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY 

RELATIONSHIP 


DAMAGE 


forward  canopy  support 
mid  canopy  support 
aft  canopy  support 


NR 

NR 

NR 


canopy  hinge 


NR 


sever 

sever 

sever 

if  more  than 
one  support 
severed,  pilot 
assumed  inca¬ 
pacitated 

sever 


K4  ESCAPE  SYSTEMS  DETONATION 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY 

RELATIONSHIP 


DAMAGE 


pilot  oxygen  bottle  NR 

pilot  rocket  catapult  NR 


penetration 

penetration 
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Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 
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Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 
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TABLE  7.4  (cont.)  Lll  LOSS  OF  HYDRAULIC  SYSTEM  NUMBER  ONE 

COMPONENT  LIST 


COMPONENT 


REDUNDANCY  DAMAGE 

RELATIONSHIP 


hydraulic  accumulator  R 
engine  driven  pump  R 
circuit  1A  R 
circuit  IB  R 


switching  and  flow  sensor  R 


penetration 
penetration 
penetration 
penetration 
penetration 
must  occur  in 
both  circuits 
to  lose  system 

penetration 


L13  LOSS  OF  BACKUP  RESERVOIR 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY 

RELATIONSHIP 


DAMAGE 


backup  reservoir 
switching  and 
sensing  monitor 
pressure  lines 
return  lines 
flow  transducer 


NR 

penetration 

NR 

penetration 

NR 

penetration 

NR 

penetration 

NR 

penetration 
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TA3LE  7.4  (cont.) 


L14  LOSS  OF  HYDRAULIC  ACTUATOR  SYSTEMS 
COMPONENT  LIST 


COMPONENT 

REDUNDANCY 

RELATIONSHIP 

DAMAGE 

left  aileron  actuator 
left  aileron  sensing 

R 

penetration 

valve 

R 

penetration 

left  stabilator  actuator 
left  stabilator  sensing 

R 

penetration 

valve 

R 

penetration 

left  rudder  actuator 
left  rudder  sensing 

R 

penetration 

valve 

R 

penetration 

Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 
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See  L21  on  next  page,  L22  follows 
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Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 


TABLE  7.4  (cont.)  L211  LOSS  OF  FLIGHT  COMPUTER  SYSTEM  NO.  1 

COMPONENT  LIST 


COMPONENT 


REDUNDANCY  DAMAGE 

RELATIONSHIP 


gyro  stabilization  system  R 
channel  1A  R 
channel  IB  R 


accelerometer  R 

rate/motion  sensor  R 


penetration 

sever 

sever 

both  channels 
must  be  sever¬ 
ed  for  loss 

penetration 

penetration 
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Figure  7.3  (cont.)  A-20  Fault  Tree  Diagram 
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TABLE  7.4  (cont.)  L2131  LOSS  OF  RAM  AIR  TURBINE  GENERATOR 

COMPONENT  LIST 


COMPONENT 


generator 
actuator  door 


REDUNDANCY 

RELATIONSHIP 

NR 

NR 


DAMAGE 


penetration 
j  am/penetration 


L2132  LOSS  OF  GENERATOR  NO . 1 
COMPONENT  LIST 


COMPONENT 

REDUNDANCY 

DAMAGE 

RELATIONSHIP 

generator 

R 

penetration 

drive  shaft 

R 

sever 

accessories  connection 

R 

penetration 

L2134  LOSS  OF  BATTERY 
COMPONENT  LIST 


COMPONENT  REDUNDANCY 

RELATIONSHIP 


DAMAGE 


NR 

NR 


penetration 

penetration 


battery 

essential  connections 


TABLE  7.4  ( cont . ) 

COMPONENT 

essential  dc  bus 


L2137 

COMPONENT 

essential  ac  bus 


L2135  LOSS  OF  ESSENTIAL 
COMPONENT  LIST 


REDUNDANCY 

RELATIONSHIP 

R 


LOSS  OF  ESSENTIAL  AC  BUS 
COMPONENT  LIST 


REDUNDANCY 

RELATIONSHIP 


NR 


DC  BUS  NO.  1 


DAMAGE 

penetration 


DAMAGE 

penetration 
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Figure  7 . 8 


(cont.)  A- 20  Fault  Tree  Diagram 


L221 ,  L222,  L223  on  next  page 


TABLE  7.4  (cont.) 


L221  LOSS  OF  LONGITUDINAL  STABILITY 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY  DAMAGE 

RELATIONSHIP 


push-pull  rods  R 
rod  ends  R 
bell  cranks  and  pulleys  R 
bearing  brackets  R 


sever 

sever 

sever 

sever 


L222  LOSS  OF  LATERAL  STABILITY 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY 

RELATIONSHIP 


DAMAGE 


interconnect  bungee  NR 

push-pull  rods  ’  R 

rod  ends  R 

bellcranks  and  levers  R 


j  am/sever 
jam/sever 
j  am/ sever 
j  am/sever 


L223  LOSS  OF  DIRECTIONAL  STABILITY 
COMPONENT  LIST 


COMPONENT 

REDUNDANCY 

DAMAGE 

RELATIONSHIP 

push-pull  rods 

R 

jam/sever 

rod  ends 

R 

j  am/sever 

bellcranks  and  levers 

R 

j  am/sever 
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TABLE  7.4  (cont.)  L3  LOSS  OF  STICK 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY 

RELATIONSHIP 


push-pull  rods  R 

rod  ends  R 

bellcranks  and  levers  R 

sensor  transducer  NR 

control  stick  NR 

stick  grip  NR 


CONTROL 


DAMAGE 


j  am/ sever 

jam/sever 

j  am/sever 

penetration 

jam/sever 

jam/sever 
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Figure  7.8  (cont.)  A-20  Fault  Tree  Diagram 
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See  Ml  and  M2  on  next  page. 


TABLE  7.4  (cont.)  Ml  EXTERNAL  MOUNTED  ORDNANCE  DETONATION 

COMPONENT  LIST 


COMPONENT 


REDUNDANCY  DAMAGE 

RELATIONSHIP 


sidewinder  warhead  (4)  R  penetration 

sidewinder  rocket  motor  (4)  R  penetration 

penetration  of 
any  one  of  the 
eight  can  cause 
attrition 


M2  STABILATOR  LOSS 
COMPONENT  LIST 


COMPONENT 


REDUNDANCY  DAMAGE 

RELATIONSHIP 


stabilator  mounting  hinge  NR 


sever 
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4 .  The  Critical  Components 


Table  7.4  lists  the  A-20's  Critical  Components  by 
name,  redundancy  relationship  (R--redundant  NR — nonredun- 
dant) ,  and  damage  or  kill  mode.  These  kill  modes  are 
representative  of  the  ones  that  Ball  [Ref.  2]  breaks  down 
by  major  systems  and  lists  in  Table  5.1  on  page  145  and 
then  discusses  briefly  on  pages  143-149.  The  kill  modes 
listed  are  the  most  important  and  most  frequently  occurring 
modes  of  attrition. 

5 .  The  Kill  Tree 

The  final  set  of  data  obtained  from  the  DMEA  is  the 
Kill  Tree  (also  called  Fault  Tree  by  MILSTD  2069  [Ref.  l:p. 
18]).  The  Kill  Tree,  shown  in  Figure  7.9,  introduces  the 
critical  components  of  the  A-20  and  illustrates  their 
logical  redundancy  relationships.  The  Kill  Tree  is  invalu¬ 
able  in  that  it  graphically  depicts  which  components  (or 
subsystems)  must  be  damaged  or  lost  produce  the  particular 
kill  level. 

Nonredundant  components  are  those  shown  in  series. 
These  components,  if  individually  killed,  are  sufficient  to 
result  in  the  kill.  Redundant  components  are  shown  in 
parallel  with  those  which  they  share  an  operational 
redundancy.  The  word  redundant  means  that  the  component 
plus  x  (x  >  1)  or  more  components  must  be  killed  to  achieve 
the  desired  kill  level. 
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Figure  7.9  A-20  Kill  Tree  Diagram 


146 


FUEL  SYSTEMS 


(fire/explosion) 


Figure  7.9  (cont.)  A-20  Kill  Tree  Diagram 
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© 


Figure  7.9  (cont.)  A-20  Kill  Tree  Diagram 
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MECHANICAL  FLIGHT  CONTROL  SYSTEM 


© 


Figure  7.9  (cont.)  A-20  Kill  Tree  Diagram 
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HYDRAULIC  300ST  SYSTEMS 


Figure  7.9  (cont.)  A-20  Kill  Tree  Diagram 


© 


HYDRAULIC  ACTUATOR  SYSTEMS 


(two  out  of  two) 


Figure  7.9  (cont.)  A-20  Kill  Tree  Diagram 
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Figure  7.9  (cont.)  A-20  Kill  Tree  Diagram 
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A  complete  cut  through  of  the  "trunk"  of  the  Kill 
Tree  is  required  to  achieve  the  A-level  attrition  kill  of 
the  A-2  0 .  In  portions  of  the  tree  where  there  are 
redundant  relationships  (such  as  the  fuel  system,  the 
flight  control  system,  the  propulsion  system  or  the 
hydraulics) ,  it  is  easily  seen  how  this  redundancy  enhances 
the  survivability  of  the  A-20.  The  more  redundant  the 
systems  are,  the  harder  it  is  to  obtain  the  A-level  kill. 
The  values  of  vulnerability  determined  in  the  vulnerability 
assessment  portion  of  this  case  study  will  show  this 
quantitatively. 

6 .  Pfk/h^  Functions  and  Critical  Components 

The  culmination  of  the  FMEA  and  DMEA  is  the  listing 
of  the  P(k/h)  functions  for  the  critical  components.  A 
representative  list  of  the  critical  components  presented  in 
Table  7.4  is  given  in  Table  7.5  This  list  of  critical 
components  is  not  comprehensive  for  the  whole  aircraft.  It 
is  made  up  of  selected  components  from  each  major  sub¬ 
system.  This  was  done  to  enable  the  reader  to  more  easily 
grasp  the  methodology  of  the  assessment,  instead  of  being 
burdened  with  trying  to  assimilate  a  very  long  and  detailed 
list.  Both  redundant  and  nonredundant  components  are 
listed  to  ensure  a  thorough  vulnerability  assessment  and 
treatment  of  component  redundancy. 

The  probability  of  kill  given  a  hit  functions 
(P(k/h))  are  the  first  quantitative  measures  of  the 


153 


TABLE  7.5  CRITICAL  COMPONENT  LIST 
BY  MAJOR  SYSTEMS  GROUPING 


MAJOR  SYSTEMS 
GROUPING 


P(k/h)  VALUES  FOR  100 
GRAIN  FRAGMENT  @  4000  FPS 
(uninstalled) 


Propulsion  Systems 

Left  and  Right 


Left  Engine  0.3 
Right  Engine  0.3 
Left  Inlet  Duct  0.5 
Right  Inlet  Duct  0.5 
Left  Throttle  Actuator  0.8 
Right  Throttle  Actuator  0.8 


Engine  Mounts 


Left  Mount  Forward  0.3 
Right  Mount  Forward  0 . 3 
Left  Mount  Aft  0.2 
Right  Mount  Aft  0.2 

Pilots  Control  Inputs 

Left  Throttle  0.6 
Right  Throttle  0.6 
Control  Stick  0.4 
Stick  Sensor  Transducer  0.5 


Hydraulics  Systems 
(No.  1,  2  and  Backup) 


Hydraulic  Pump  No.  1  0.4 

Hydraulic  Pump  No.  2  0.4 

Hydraulic  Circuit  1A  0.5 

Hydraulic  Circuit  IB  0.5 

Hydraulic  Circuit  2A  0.5 

Hydraulic  Circuit  2B  0.5 

No.  1  Accumulator  0.7 

Backup  Reservoir  0.6 

Backup  Switching/Sensing  Monitor  0.4 

Left  Aileron  Actuator  0.35 
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TABLE  7.5  (cont.)  CRITICAL  COMPONENT  LIST 
BY  MAJOR  SYSTEMS  GROUPING 


MAJOR  SYSTEMS 
GROUPING 


P(k/h)  VALUES  FOR  100 
GRAIN  FRAGMENT  @  4000  FPS 
(uninstalled) 


Hydraulics  Systems 

(No.  1,  2  and  Backup-cont . ) 


Right  Rudder  Actuator  0.35 

Left  Stabilator  Actuator  0.35 

Right  Stabilator  Actuator  0.35 

Left  Aileron  Sensing  Valve  0.6 

Right  Rudder  Sensing  Valve  0.5 

Right  Stabilator  Sensing  Valve  0.45 


Fuel  System  Fire/Explosion 


Left  Fuel  System  Ullage  0.3 

Fuel  in  Motive  Flow  Lines  0.8 

Fuel  in  Wing  Tanks  0.4 

Fuel  in  Forward  Feed  Tank  0.2 

Fuel  in  Aft  Transfer  Tank  0.25 

Wing  Tank  Ullage  0.75 

Longitudinal  Transfer  Tank  Ullage  0.65 


Flight  Controls — Electrical 


AFCS  No.  1  (gyro  stabilizer,  accel-  0.3 

erometer,  rate/motion  sensor) 

AFCS  No.  2  (gyro  stabilizer,  accel-  0.3 

erometer,  rate/motion  sensor) 

AFCS  Channel  1A  0.5 

AFCS  Channel  IB  0.5 

AFCS  Channel  2A  0.5 

AFCS  Channel  2B  0.5 

Generator  No.  1  0.2 

Battery  0 . 3 

Essential  DC  Bus  No.  1  0.45 

Essential  AC  Bus  0.4 
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TABLE  7.5  (cont.)  CRITICAL  COMPONENT  LIST 
BY  MAJOR  SYSTEMS  GROUPING 


MAJOR  SYSTEMS 
GROUPING 


P(k/h)  VALUES  FOR  100 
GRAIN  FRAGMENT  @  4000  FPS 
(uninstalled) 


Flight  Controls  Mechanical 

Longitudinal  Stability  Cables  0.5 
Directional  Stability  Linkages  0.3 
Lateral  Stability  Cables  0.4 


Structure 


Middle  Canopy  Frame  Support  0.25 

Forward  Longerons  0.15 

Aft  Longerons  0.10 

Left  Wing  inboard  Spar  Caps  .  0.2 

Right  Wing  Outboard  Spar  Caps  0 . 2 

Crew  Member 

Pilot  1.0 


Armament/Weaoons  System 


Missile  Motor 
Missile  Warhead 
Cannon  Ammo  Drum 


0.8 

1.0 

0.6 


aircraft's  survivability.  They  are  a  measure  of  the  prob¬ 
ability  of  component  kill  when  impacted  by  a  fragment. 
Normally,  the  P(k/h)  functions  are  listed  as  a  2-axis  graph 
(see  Figure  3.7),  relating  the  damage  mechanism's  size  and 
velocity  at  impact.  For  example  (from  Figure  3.7),  the 
P(k/h)  value  for  a  120  grain  fragment  travelling  at  4000 
feet  per  second  is  0.62.  This  method  of  analysis  involves 
many  man-hours  at  test  facilities  for  ballistic  testing  of 
the  projectile  and  resultant  component  damage.  The  P(k/h) 
values  determined  from  these  functions  are  computed  for  the 
uninstalled  component  and  are  employed  for  all  attack 
directions  and  impacts  anywhere  on  the  component. 

For  this  case  study  the  presentation  of  assessment 
methodology  is  the  goal.  For  this  reason,  the  list  of 
critical  components  has  a  respective  P(k/h)  value,  not 
function,  assigned  to  each  component.  These  values  are 
for  generic  components  and  are  not  based  on  any  actual 
aircraft.  They  are  based  on  the  assumption  of  the 
uninstalled  component  being  struck  by  a  single  fragment  at 
a  velocity  of  4000  feet  per  second  (fps) .  These  values 
will  be  used  as  the  starting  point  or  baseline  values  in 
the  vulnerability  assessment.  The  location  of  the 
component  inside  the  system  and  the  aircraft  structure  has 
a  definite  influence  on  its  ultimate  numerical  value  for 
probability  of  kill  given  a  hit.  Component  and  structural 
shielding  reduces  the  velocity  of  the  damage  mechanism 
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and  as  such  its  lethality.  This  results  in  a  change  in  the 
P(k/h)  values  for  the  components  used  in  the  assessment. 
This  change,  and  the  detailed  reasoning  behind  it,  will  be 
described  in  the  vulnerability  assessment  in  the  next 
chapter. 


VIII.  A-20  VULNERABILITY  ASSESSMENT 


The  vulnerability  assessment  of  the  A-20  will  be  the 
final  survivability  program  task  performed  in  this  case 
study.  The  methodology  for  this  assessment  is  found  in 
Chapter  5  of  Ball  [Ref.  2:pp.  153-221].  Ball  presents  all 
the  possible  techniques  and  situations  for  vulnerability 
assessment,  ranging  from  single  hit  vulnerability  for  a 
non-explosive  penetrator  or  fragment  (pages  158-158) ,  to 
multiple  hit  vulnerability  (pages  169-180) ,  to  vulnerabil¬ 
ity  to  internally  and  externally  detonating  warheads  (pages 
183-191) . 

This  assessment  of  the  A-20  will  determine  the  air¬ 
craft's  vulnerability  to  a  single  fragment.  The  damage 
mechanism  used  is  the  100  grain  fragment  from  the  SA-X,  the 
same  one  that  the  uninstalled  P(k/h)  values  are  based  on. 
The  methodology  used  for  the  single  hit  vulnerability  is 
essentially  the  same  as  that  used  by  the  computer  programs 
FASTGEN  and  COVART  [Ref.  2:pp.  192-195].  In  these  pro¬ 
grams,  the  single  hit  vulnerable  area  of  the  aircraft  and 
it's  components  can  be  assessed  from  26  different  aspects 
(Figure  8.1).  For  the  A-20  assessment,  the  45  degree  azi¬ 
muth  and  45  degree  elevation  aspect  (Figure  8.2)  will  be 
used  to  show  the  methodology  involved  in  obtaining  numeri¬ 
cal  values  for  the  single  hit  vulnerability  of  the  A-20. 
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Figure  8 . 1  The  Aircraft  Assessment  Aspects 
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In  order  to  simulate  the  FASTGEN/COVART  computer  analy¬ 
sis,  a  grid  with  sections  measuring  5  feet  by  5  feet  is 
superimposed  over  the  A-20  (Figure  8.3),  Each  5  foot  by  5 
foot  section  is  subdivided  into  25  one  square  foot  cells  to 
provide  a  uniform  grid  cell  area  to  work  from.  A  shotline 
is  randomly  located  in  each  of  the  one  square  foot  cells. 
These  shotlines  will  be  followed  as  they  travel  completely 
through  the  aircraft. 

For  the  sake  of  simplicity,  just  three  shotlines  will 
be  examined  in  detail  (Figure  8.3).  These  shotlines  illus¬ 
trate  the  different  types  of  component  situations  that  may 
be  encountered  when  doing  a  single  hit  vulnerability  asses¬ 
sment  on  an  aircraft.  These  situations  are: 

1.  Nonredundant  components  with  overlap,  (shotline  1) 

2.  Redundant  components  with  no  overlap,  (shotline  2) 

3.  Redundant  components  with  overlap.  (shotline  3) 

Figures  8.4  through  8.9  show  the  shotlines  passing  through 
the  various  critical  components.  Table  8.1  is  the  list  of 
components  that  lie  on  each  shotline. 

A.  VULNERABILITY  CALCULATIONS 

For  each  shotline  situation  assessed,  the  component 

presented  area  is  the  area  of  one  cell  in  the  grid,  i.e. 

2 

one  square  foot  (1  ft. -).  The  P(k/h)  values  of  the  com¬ 
ponents  will  be  affected  by  their  location  within  the 
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Figure  3.3  A-20  Shotline  Grid 
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Figure  8.4  Fuel  System  Shotline  Intercepts 
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HEFT  VENT  TANK  8-RIGHT  VENT  TANK 
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\ 

Figure  8.8  Armament  System  Shotline  Intercepts 
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Figure  8.9  Structural  System  Shotline  Intercepts 
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TABLE  8.1 


CRITICAL  COMPONENTS  INTERSECTED  BY  SHOTLINES 


Shotline  No.  1 


1.  Pilot 

2 .  Mechanical  Stabilator  Linkage 

3.  Right  Longitudinal  Transfer  Tank 

4 .  Forward  Keel  Right  Longeron 


Shotline  No.  2 

1.  Left  Inlet  Duct 

2 .  Forward  Feed  Tank 

3.  Hydraulic  Feed  Line  Circuit  No.  1 

4.  Mechanical  Aileron  Linkage  Mechanism 

5.  Outboard  Starboard  Missile  Motor 

6.  Right  Longitudinal  Transfer  Tank 

7 .  Center  Keel  Right  Longeron 


Shotline  No.  3 

1.  Aft  Side  Left  Longeron 

2.  Left  Rudder  Hydraulic  Actuator 

3.  Left  Engine 

4 .  Left  Fuel  Vent  Line 

5.  Accessories  Section 

6.  Left  Fuel  System  Motive  Flow  Line 

7.  Mechanical  Rudder  Linkage 

8 .  Right  Engine 

9.  Aft  Keel  Right  Longeron 
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aircraft.  As  will  be  seen,  the  P(k/h)  values  used  in  the 
analysis  are  less  than  the  uninstalled  values  presented  in 
the  previous  chapter  (Table  7.5).  This  is  because  the 
lethality  of  each  fragment  is  based  on  its  striking  velo¬ 
city  on  the  component.  Due  to  shielding  and  overlap,  the 
degree  of  lethality  is  inversely  proportional  to  the  dis¬ 
tance  the  fragment  travels  through  the  aircraft.  In  other 
words,  as  the  fragment  slows  down,  the  resultant  P(k/h) 
value  for  a  hit  component  is  less  than  its  uninstalled 
value . 

1 .  Definitions 

The  following  definitions  parallel  Ball's  [Ref. 
2:pp.  158-159]  explanation  of  the  variables  used  in  a 
vulnerability  assessment.  In  this  assessment,  everything 
is  related  to  the  cell  presented  area,  whereas  Ball 
presents  the  methodology  based  on  component  presented  area. 
The  explanations  given  below  refine  Ball's  notation. 


ci:  This  subscript  represents  the  "ith"  component 

on  the  "cth"  shotline.  In  this  case  study, 
"c"  will  have  the  value  of  1,  2  or  3 ,  depend¬ 
ing  on  the  particular  cell  or  shotline  being 
analyzed.  Shotline/cell  1  (li)  is  the  for¬ 
ward  shotline  (entry  thru  the  cockpit — see 
Figure  8.3).  Shotline/cell  2  (2i)  is  the 
the  middle  shotline  (entry  thru  the  left  in¬ 
let  duct) .  Shotline/cell  3  ( 3 i )  is  the  aft 

shotline  (entry  thru  the  left  engine) . 


A<v  .>:  The  vulnerable  area  of  the  "ith"  component  on 

the  "cth"  shotline.  The  number  that  "i"  re¬ 
presents  is  the  number  assigned  to  the  compo¬ 
nent  in  Table  8.1.  For  example,  from  Table 
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8.1,  the  mechanical  stabilator  hinge  is  in¬ 
tersected  by  shotline  1.  The  vulnerable  area 
of  the  hinge  is  defined  by  the  symbology 
A<v12>. 

A<p  >  and: 

A<P  > 
c 

The  presented  area  of  each  cell.  As  mention¬ 
ed  earlier,  this  value  is  a  constant 
at  1.0  square  feet. 

P<s/h  . > : 

Cl 

The  probability  of  the  "ith"  component  on  the 
"cth"  shotline  surviving,  given  a  hit  on  this 
component. 

P<k/h  . > : 

Cl 

The  probability  of  the  "ith"  component  on  the 
"cth"  shotline  being  killed  given  a  hit  on 
this  component.  These  values  are  also  known 
as  the  installed  P<k/h>  values. 

P<S/Hc>: 

The  probability  of  the  aircraft  surviving 
given  a  hit  on  the  "cth"  cell. 

P<K/Hc> : 

The  probability  of  the  aircraft  being  killed 
given  a  hit  on  the  "cth"  cell. 

A<V  > : 
c 

The  vulnerable  area  of  the_"cth"  cell. 

A<P> : 

The  presented  area  of  the  entire  aircraft. 
Using  Figure  8.2  this  was  determined  to  be 
399.0  square  feet. 

P<S/H> : 

The  aircraft  probability  of  survival  given  a 
random  hit  on  the  aircraft. 

P<K/H> : 

The  aircraft  probability  of  kill  given  a 
random  hit  on  the  aircraft. 

A<V> : 

The  total  single  hit  vulnerable  area  of  the 
aircraft,  relative  to  the  presented  aspect. 
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2 .  Mathematical  Relationships 


The  following  mathematical  relationships  will  be 
used  to  determine  the  single  hit  vulnerability  of  the  A-20. 
Ball  [Ref.  2],  presents  these  relationships  on  pages  159- 
169.  For  "n"  components  along  a  shotline  and  "N"  cells  on 
the  aircraft: 


P<S/Hc> 

— 

(P<s/hcl>) (P<s/hc2>)  .  .  .  (<Ps/hcn>) 

(8.1) 

P<s/hc^> 

= 

1  -  P<k/h  .> 

Cl 

(8.2) 

A<v  .  > 

Cl 

= 

(P<k/hci>) (A<pc>) 

(8.3) 

P<K/Hc> 

= 

1  -  P<S/Hc> 

(8.4) 

A<V  > 
c 

= 

(P<K/Hc>) (A<Pc>) 

(8.5) 

A<V>  ■ 

= 

A<V.  >  +  A<V_>  +  .  .  .  +  A<V.t> 

12  N 

(8.6) 

P<K/H> 

= 

A<V>/A<P> 

(8.7) 

P<S/H> 

= 

1  -  P<K/H> 

(8.8) 

3 .  Nonredundant  Components  with  Overlap  (shotline  1) 

This  first  situation  is  specifically  addressed  by 
Ball  [Ref.  2:pp.  163-166],  The  components  intersected  by 
shotline  1  will  be  used  to  show  the  methodology  for  this 
situation.  The  results  of  the  analysis  on  this  shotline 
will  be  values  for  P<K/H1>  and  A<V1>. 
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The  list  of  components  that  are  intersected  by 

shotline  1  are  given  in  Table  8.1  and  are  also  listed  in 

Table  8.2.  The  uninstalled  P<k/h>  values  for  each  of  these 

components  (P<k/hun>) ,  is  given  in  Table  7.5  and  is  also 

given  in  Table  8.2.  The  P<k/h>  value  for  the  installed 

components  (P<k/h  .>)  has  been  estimated  and  is  presented 

in  Table  8.2.  The  component  vulnerable  are  in  each  cell 

(A<vc^>)  is  equal  to  the  P<k/hc^>  value  because  of  the  fact 

that  each  cell's  presented  area  (A<p  >  is  equal  to  one 

c 

square  foot.  This  will  be  true  for  all  three  situations. 


TABLE  8.2  SHOTLINE  1 
NONREDUNDANT  COMPONENTS  WITH  OVERLAP 


Component 


1 


1.  pilot 


1.0 


0.9 


2.  mechanical  stabilator 
hinge 


0.3 


0.2 


3 .  right  longitudinal 
transfer  tank 


0.65 


0.3 


4.  forward  keel  right 
longeron 


0.15 


0.10 


1 


A<v  . >  is  in  square  feet 
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For  this  situation,  the  mathematics  will  be  pre¬ 
sented  in  detail,  showing  equations,  value  substitutions, 
and  methodology.  The  other  two  situations  will  be  pre¬ 
sented  by  citing  appropriate  equations  and  values.  The 
only  portions  that  will  be  examined  in  detail  in  the  other 
two  situations  are  those  that  make  each  one  unique. 

To  determine  the  vulnerability  measures  of  the  air¬ 
craft  given  a  hit  on  cell  1,  the  following  methodology  is 
followed: 

Using  Eqns.  (8.1)  and  (8.2)  and  the  data  given  in  Table 

8.2,  the  value  for  P<S/H^>  is  determined  from 

P<S/H1>  =  (1  -  P<k/h11>) (1  -  P<k/h12>)(l  -  P<k/h13>) 

(1  -  P<k/h14>). 

Substituting  the  values  for  P<k/h..>  from  Table  8.2  into 

the  expression  for  P<S/H1>  gives  1 

P<S/H1>  =  (1_-  0.9) (1  -  0.2) (1  -  0.3) (1  -  0.1) 

=  0.050. 

Using  Eqn.  (8.4)  to  determine  the  probability  of  killing 

the  aircraft  given  a  hit  on  cell  1  gives 

P<K/H1>  =  1  -  P<S/H1> 

=  1  -  0.050 
=  0.950. 
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Equation  (8.5)  is  used  to  determine  the  vulnerable  area 
of  cell  1.  This  value  will  be  used  later  to  determine 
the  A<V>  of  the  aircraft  and  the  P<K/H>  of  the  aircraft. 
According  to  Eqn.  (8.5) 

A<V1>  =  (P<K/H1>) (A<PX>) 

=  (0.950) (1.0  ft.2) 

=  0.950  ft.2 

The  only  difference  between  the  A-20  assessment 
given  here  and  Ball's  approach' is  that  Ball  [Ref.  2]  uses 
the  total  presented  area  of  the  component  to  determine  the 
component  vulnerable  area.  However,  this  procedure  (which 
is  equivalent  to  the  computerized  procedure)  treats  each 
cell  as  a  unique  "component".  Eventually,  the  total  vulner¬ 
able  area  of  each  component  is  computed  as  the  sum  of  the 
component  vulnerable  areas  on  each  cell. 

This  first  situation  resulted  in  a  high  value  for 
the  P<K/H1>.  This  value  reflects  the  lack  of  component 
redun-  dancy  in  this  part  of  the  aircraft.  The  next 
situation,  redundant  components  with  no  overlap,  shows  how 
redundancy  can  reduce  the  P<K/Hc>  value. 

4 .  Redundant  Components  with  No  Overlap  (shotline  2) 

This  second  situation  is  addressed  by  Ball  [Ref. 
2:pp.  166-168].  Table  8.3  presents  the  components 
intersected  by  shotline  2  and  their  uninstalled  P<k/h> 
values. 
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TABLE  8.3  SHOTLINE  2 
REDUNDANT  COMPONENTS  WITH  NO  OVERLAP 


Component 

p<k/hun> 

P<k/h  . >  &  A<v 

'  Cl  i 

1. 

left  inlet  duct 

0.5 

0.4 

2 . 

forward  feed  tank 
(fire/explosion) 

0.2 

0.15 

2a. 

cascade  ef fect--forward 
feed  tank  penetration 
result:  hydraulic  ram 
and  left  engine  kill 

0.25 

3  . 

hydraulic  feed  line  cir¬ 
cuit  no.  1  (Redundant) 

0.5 

0.3 

4. 

mechanical  aileron  link¬ 
age  mechanism 

0.3 

0.1 

5. 

outboard  starboard  mis¬ 
sile  motor 

0.8 

0.5 

6 . 

right  longitudinal  trans¬ 
fer  tank 

0.65 

0.20] 

7. 

center  keel  right  lon¬ 
geron  (Redundant) 

0.15 

0.05 

1A<v  . >  is  in  square  feet. 


These  components  will  be  used  to  assess  the  effect 
of  redundancy  in  components  and  also  to  show  the  effect 
of  cascading  damage  [Ref. 2:  pp.  165-166].  Component  re¬ 
dundancy  has  a  significant  effect  on  the  values  of 
P<S/H2>  and  A<V2>.  A  single  hit  on  the  cell  will  not  kill 
enough  of  the  redundant  components  to  cause  a  kill  of  the 
aircraft.  (The  theory  and  logic  behind  this  statement  is 
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shown  by  Ball  on  pages  167-168,  Eqns.  (5.22a-d).  This 
results  in  the  redundant  components  not  being  a  factor 
in  the  calculations  for  the  aircraft's  vulnerability 
measures . 

Cascading  damage  also  has  a  significant  effect  on 
the  aircraft's  vulnerability.  This  is  a  type  of  damage  to 
a  component  not  actually  hit  by  the  damage  mechanism  but 
that  is  damaged  due  to  the  response  of  the  hit  component. 
This  damage  may  or  may  not  be  severe  enough  to  cause  a 
loss  of  the  aircraft.  This  cascading  effect  will  be  ill¬ 
ustrated  by  examining  the  consequences  of  the  hit  on  the 
forward  feed  tank,  component  3. 

The  cascading  effect  of  forward  feed  tank's  damage 
essentially  "creates"  another  critical  component.  In  this 
situation,  the  fuel  tank  can  be  killed  by  a  fire/explosion 
with  a  P<k/h>  of  0.15  as  shown  in  Table  8.3.  The  cascade 
effect  occurs  when  the  fuel  tank  is  hit  and  hydraulic  ram 
causes  it  to  weaken  structurally  to  the  point  where  fuel 
leaks  from  the  tank  into  the  left  inlet  duct  and  is  ingest¬ 
ed  by  the  engine.  This  in  turn  causes  a  kill  of  the  engine 
and  hence  the  aircraft.  The  probability  that  this  occurs 
is  found  to  be  0.25  (Table  8.3). 

Since  the  engine  is  not  located  along  this  shot¬ 
line,  P<k/h  .>  and  A<v  .>  values  for  the  "created"  com- 
ponent  must  be  determined  for  this  situation  using  the 
P<k/h>  data  and  Ball's  methodology  on  pages  163-165.  The 
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aircraft  can  survive  the  hit  in  the  fuel  tank  if  there  is 
neither  a  fire  kill  or  a  fuel  ingestion  kill  of  the  engine. 
The  probability  that  neither  of  these  will  occur  is  found 
by  utilizing  Eqn.  (8.2).  The  product  of  the  probability 
that  there  is  no  fire,  (1  -  0.15),  and  the  probability  that 
there  is  no  fuel  ingestion  kill  of  the  engine,  (1  -  0.25), 
is  0.64.  Therefore,  the  probability  of  kill  of  this 
"created"  component  considering  the  cascading  effect  is 
(1  -  0.64)  =  0.36.  Thus,  by  accounting  for  the  cascading 
effect  of  the  fuel  tank  damage  a  critical  component  is 
"created"  for  this  situation  whose  probability  of  kill  is 
greater  than  either  of  the  components  that  contributed  to 
its  creation. 

The  analysis  of  this  situation  will  be  presented  in 
two  parts.  The  first  part  will  show  the  effects  of  the 
cascading  damage  on  the  P<K/H2>,  and  A<V2>  values.  The 
second  part  will  show  how  the  values  change  without  the 
cascading  damage  being  a  factor. 

The  values  for  P<S/H2>,  P<K/H2>  and  A<V2>  for  the 
redundant  and  cascading  situation  are  calculated  using  the 
same  methodology  and  equations  (8.1  thru  8.5)  as  in  the 
first  situation.  For  the  cascading  damage  problem,  only 
six  components  (1,  2,  2a,  4,  5  and  6)  are  used  to  determine 
the  vulnerability  values.  As  shown  in  Table  8.3,  compo¬ 
nents  3  and  7  are  redundant  and  do  not  contribute  to  the 
aircraft's  single  hit  vulnerability  (Note,  however,  that 
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every  component,  redundant  or  not,  has  a  vulnerable  area  as 
given  in  Table  8.3). 


The  computed  values  for  redundancy  and  cascading  damage 
without  overlap  are  as  follows: 


P<S/H2> 

=  (1  -  0.4) ( 1  -  0.15) (1  -  0.25) ( 1  -  0.1) (1  -  0.5) 

(1  -  0.2) 

see  (8.1) 

=  0.138. 

(The  product  of  the 
the  above  equation 
(8.1) ,  (1  -  0.64) 

the  P<k/h>  of  the 
nent . ) 

second  and  third  terms  in 
equals  0.64.  From  Eqn. 
equals  0.36,  the  value  of 
"created"  critical  compo- 

p<k/h2> 

=  1  -  0.138 

see  (8.4) 

=  0.862. 

a<v2> 

=  0.979  ft.2 

see  (8.5) 

For  comparative  purposes,  the  following  values  were  com¬ 
puted  as  if  component  redundancy  did  not  exist  in  the 
above  situation: 

P<S/H2>  =  0.092.  see  (8.1) 

P<K/H2>  =  0.908.  see  (8.4) 

A<V2>  =  0.908  ft.2  see  (8.5) 


From  this  simple  comparative  example  shown,  it  can 
be  seen  that  component  redundancy  does  decrease  the  prob¬ 
ability  of  aircraft  kill  given  a  hit  in  cell  2. 

If  cascading  damage  was  not  considered  in  this  sit¬ 
uation,  then  the  engine  kill  is  not  considered  and  the 
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third  term  ((1  -  0.25))  in  the  expression  for  P<S/H2>  be¬ 
comes  unity.  Calculations  of  the  vulnerability  values  for 
both  the  redundant  and  nonredundant  situations  (for 
comparative  purposes)  follow. 

The  non-cascading  redundant  component  calculations  use 
only  components  1,  2,  4,  5  and  6  (As  labeled  in  Table 


00 

• 

CO 

P<S/H2>  =  0.184. 

see  (8.1) 

P<K/H2>  =  0.816. 

see  (8.4) , 

A<V2>  =  0.816  ft.2  see  (8.5) 

The  non-cascading  nonredundant  component  calculations 
use  components  1,  2,  3,  4,  5,  6  and  7: 


P<S/H2>  =  0.122. 

see  (8.1) 

P<K/H2>  =  0.878. 

see  (8.4) 

A<V2>  =  0.878 

ft.2  see  (8.5) 

These  analyses  show  the  importance  of  properly  con¬ 
sidering  cascading  damage  and  component  redundancy.  By 
eliminating  the  cascading  damage  problem,  the  survivability 
of  the  aircraft  if  hit  in  this  cell  increases  significantly 
(P<S/H2>  of  0.184  vice  0.122).  This  is  a  design  considera¬ 
tion  that  will  be  discussed  later  in  this  chapter. 
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5 .  Redundant  Components  with  Overlap  ( shotline  3) 


The  final  situation  discussed  is  where  redundant, 
overlapping  components  occur  along  the  same  shotline  (shot¬ 
line  3).  Table  8.4  provides  the  components  as  intersected 
by  shotline  3.  Ball  [Ref.  2],  addresses  this  situation  on 
pages  168-169  of  his  text.  Specifically,  Eqns.  (5.22a)  and 
(5.22b)  [Ref.  2:p.  167]  show  how  redundancy  and  overlap  are 
handled.  In  this  situation,  a  single  hit  in  the  overlap 
region  has  the  probability  of  killing  both  engines.- 

The  calculations  that  follow  exhibit  the  method¬ 
ology  required  for  this  situation.  Comparative  values  are 
also  computed  to  show  the  probabilities  if  there  was  no 
overlap  in  the  region. 

The  methodology  for  calculating  the  vulnerability 
values  is  very  similar  to  that  displayed  in  the  first  two 
situations.  The  difference  is  noticed  when  accounting  for 
the  redundant,  overlapping  engines.  This  is  handled  by 
applying  Ball's  Eqn.  (5.22b)  [Ref.  2:p.  167]  to  the  en¬ 
gines  and  the  author's  Eqns.  (8.1)  and  (8.2)  as  follows: 

p<s/h3>  =  (1  -  (P<k/h33>) (P<k/h38>) ) (1  -  p<k/h34>) 

(1  -  P<k/h35>) (1  -  P<k/h36>) (1  -  P<k/h37>) 

(1  -  P<k/h32>). 
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TABLE  8.4  SHOTLINE  3 
REDUNDANT  COMPONENTS  WITH  OVERLAP 


Component 
1 


P<k/hun> 


P<k/h  •>  &  A<v  . >" 
'  ci  ci 


aft  side  left  longer¬ 
on  (Redundant  without 


Overlap) 

0.10 

0.07 

2. 

left  rudder  hydraulic  ac¬ 
tuator 

0 . 35 

0.3 

3. 

left  engine  (Redundant 
with  Overlap) 

0.3 

0.25 

4  . 

left  forward  fuel  vent  line 

0.4 

0.35 

5. 

accessories  section 

0.6 

0.2 

6. 

left  fuel  system  motive 
flow  line 

0.8 

0.65 

7. 

mechanical  rudder  linkage 

0.3 

0.2 

8. 

right  engine  (Redundant 
with  Overlap) 

0.3 

0.15 

9. 

aft  keel  right  longer¬ 
on  (Redundant  without 

Overlap) 

0.10 

0 . 01 

A<vc^>  is  in  square  feet 
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Note  that  components  1  and  9  are  not  included  in  these 
calculations  because  they  are  redundant  (with  other  com¬ 
ponents  not  on  the  shotline)  and  do  not  overlap.  The 
vulnerability  values  are  as  follows: 


p<s/h3> 


p<k/h3> 


a<v3> 


(1  -  (0.25)  (0.15) )  (1  -  0.35)  (1  -  0.2)  ( 1  -  0.65) 

(1  -  0.2) (1  -  0.3)  see  (8.1) 

0.098. 

1  -  0.098  see  (8.4) 

0.902 . 

0.902  ft.2  see  (8.5) 


If  the  shotline  did  not  not  intersect  the  two  redundant, 
overlapping  components,  the  method  of  calculation  is  the 
same  as  in  the  second  situation  discussed,  redundant  com¬ 
ponents  without  overlap.  The  comparative  calculations 
are  as  follows: 

P<S/H3>  =  0.101.  see  (8.1) 

P<K/H3>  =  0.898.  see  (8.4) 

A<V3>  =  0.898  ft.2  see  (8.5) 

With  redundancy  and  no  overlap,  the  aircraft's 
chances  of  survival  increase  from  0.098  to  0.101.  The 
overlap  area  has  a  definite  detrimental  affect  on  the  air¬ 
craft  survivability  from  this  aspect  being  assessed. 
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6 .  Overall  Aircraft  Survivability 


Equations  (8.6),  (8.7)  and  (8.8)  provide  the  math¬ 

ematical  relationships  needed  to  determine  the  overall  vul¬ 
nerable  area  and  probability  of  survival. 

From  the  aspect  presented  in  Figure  8.2,  the  value  for  N 
in  Eqn.(8.6)  is  449  cells.  For  the  sake  of  brevity,  the 
A<V>  of  the  aircraft  was  estimated  to  be 

A<V>  =  0.950  ft.2  +  0.979  ft.2  +  0.902  ft.2  +  A<V4>  + 

...  +  A<VXI> 

N 

2 

=  300.0  ft.  (estimate  for  methodology) 

The  P<K/H>  is  determined  from  Eqn.  (8.7).  The  aircraft's 
A<P>  =  399.0  square  feet. 

P<K/H>  =  A<V>/A<P> 

=  300.0  ft . 2/399 . 0  ft.2 

=  0.752. 

The  P<S/H>  of  the  A-20  is  calculated  by  using  Eqn.  (8.8): 
P<S/H>  =  1  -  P<K/H> 

=  1  -  0.752 
=  0.248. 


These  values  may  not  seem  to  be  very  realistic, 
nor  are  they  necessarily  intended  to  be.  As  has  been  re¬ 
peatedly  stated  throughout  this  case  study,  all  values  used 
are  based  on  the  author's  desire  to  present  the  assessment 
in  a  clear,  concise  and  unclassified  manner.  This  case 
study  is  meant  to  show  the  methodology  involved  in 
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conducting  a  vulnerability  assessment,  not  to  determine 
actual,  viable  vulnerability  values. 

B.  VULNERABILITY  REDUCTION  FEATURES 

The  remainder  of  this  chapter  briefly  discusses  several 
of  the  vulnerability  reduction  features  that  Ball  presents 
in  his  text  [Ref.  2:pp.  199-221]  and  how  they  relate  to  the 
A-2 0  and  this  assessment. 

1 .  The  Fuel  System 

The  A-2 0  does  have  some  vulnerability  reduction 
features  inherent  in  it's  design,  such  as  foam  in  the  wing 
tanks,  fuel  feed  line  redundancy,  motive  flow,  a  "get  home 
fuel"  compartment  in  the  main  feed  tank  and  the  majority  of 
the  plumbing  on  the  interior  of  the  tanks.  The  A-2 O' s 
greatest  fuel  system  design  flaw  is  the  location  of  the  the 
fuel  tanks.  Ball  [Ref.  2],  presents  an  analysis  of  this 
problem  on  pages  203-204.  The  A-20's  longitudinal  transfer 
tanks  present  too  much  exposed  surface  area;  and  as  seen 
from  the  single  hit  vulnerability  assessment,  the  forward 
feed  tank  is  located  in  a  position  where  engine  fuel  inges¬ 
tion  caused  by  fragment  penetration  can  have  catastrophic 
results . 

2 .  The  Propulsion  System 

The  A-20's  propulsion  system  does  have  redundancy 
in  the  engines  and  mounting  system.  The  major  flaw  in  it's 
design  is  with  it's  location  adjacent  to  a  fuel  tank  (See 
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Ball  [Ref.  2:pp.  214-215]).  The  inlet  duct  is  situated 
such  that  fuel  ingestion  with  resultant  engine  fire  is  a 
possibility.  On  the  other  hand,  the  inlet  ducts  are  mount¬ 
ed  in  such  a  fashion  that  they  are  shielded  from  ground 
fire. 

3 .  The  Flight  Control  System 

The  A-20's  flight  control  system  is  multiply  redun¬ 
dant.  It  is  unusual  in  that  it  has  a  complete  mechanical 
backup  to  the  AFCS.  The  component  placement  of  the  hydrau¬ 
lic  reservoirs  which  store  the  fluid  to  actuate  the  flight 
control  surfaces  is  a  weakness  of  the  A-20  design.  The 
main  reservoirs  are  located  beneath  the  engines  with  the 
majority  of  surface  area  vulnerable  to  ground  fire.  Ball 
[Ref.  2:pp.  199-200]  writes  about  the  positioning  of  crit¬ 
ical  components  to  where  they  are  shielded  and  kept  away 
from  any  component  that  might  contribute  to  cascading 
damage,  such  as  hydraulic  fluid  finding  its  way  onto  the 
hot  engine. 

4 .  The  Crew  System 

The  A-20  carries  no  armor  for  the  pilot  (See  Ball 
[Ref.  2:pp.  220-221]).  For  the  type  mission  it  is  designed 
for,  armor  might  be  a  viable  tradeoff  to  reduce  the  pilot's 
installed  P<k/h>.  The  cockpit  location  in  the  vertical 
plane  is  also  a  design  feature  that  needs  some  work.  The 
height  at  which  the  pilot  sits  presents  more  exposed  body 
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surface  area  than  desired.  There  is  room  to  lower  the 
cockpit  in  the  design  configuration. 

All  of  these  vulnerability  reduction  features  (and 
others) ,  were  considered  when  the  author  was  performing  a 
second  iteration  on  the  A-20's  design.  The  second  itera¬ 
tion  of  the  A-20  is  shown  in  Figure  8.10.  Notice  how  the 
intake  has  been  moved  aft,  away  from  the  forward  fuel  tank 
and  also  the  possibility  of  cannon  exhaust  ingestion.  The 
cockpit  has  been  lowered,  and,  although  not  visible,  there 
are  spall  shields  in  the  cockpit.  Part  of  the  fuselage, 
just  aft  of  the  pilot  has  been  more  aerodynamically  shaped 
to  provide  for  better  airflow  to  the  inlets  (And  a  possible 
reduction  in  the  aircraft's  radar  cross  section).  This  has 
also  resulted  in  a  reduction  of  frontal  area.  Another  fea¬ 
ture  worth  investigating  is  the  feasibility  of  2-D  nozzles 
as  shown  in  the  figure. 
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Figure  3.10 


A-20  Design  Improvements 
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IX.  RECOMMENDATIONS 


The  single  hit  vulnerability  assessment  and  the  steps 
leading  up  to  it  are  just  the  first  ones  that  are  necessary 
to  produce  the  complete  methodology  of  a  survivability 
assessment.  The  following  are  recommendations  for  follow 
on  areas  of  concentration  to  complete  this  assessment: 

1.  Produce  a  methodology  addressing  the  multiple  hit 
vulnerability  of  the  A-20  [Ref.  2:pp.  169-180]. 

2.  Determine  the  A-20's  vulnerability  to  internally  and 
externally  detonating  warheads  [Ref.  2:pp.  183-191]. 

3.  Produce  a  case  study  assessing  the  A-20's  suscepti¬ 
bility  (RCS,  IR  radiation,  etc.)  using  Ball's 
methodology  [Ref.  2:pp.  227-311]. 

4.  Tie  in  both  the  overall  vulnerability  and  suscepti¬ 
bility  assessments  to  produce  a  scenario  dependent 
overall  survivability  assessment  of  the  A-20  (See 
Ball  [Ref.  2 :pp.  316-337]). 
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